Report

by the Comptroller
and Auditor General

Ministry of Defence

Investigation into national security vetting

HC 1500 Session 2017–2019 7 September 2018

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund, nationally and locally, have used their resources efficiently, effectively, and with economy. The C&AG does this through a range of outputs including value-for-money reports on matters of public interest; investigations to establish the underlying facts in circumstances where concerns have been raised by others or observed through our wider work; landscape reviews to aid transparency; and good-practice guides. Our work ensures that those responsible for the use of public money are held to account and helps government to improve public services, leading to audited savings of £741 million in 2017.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 6 September 2018

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

5 September 2018

United Kingdom Security Vetting (UKSV), established in January 2017, is responsible for vetting individuals to allow them access to sensitive government information, locations or equipment. During 2017, a number of UKSV’s customers became concerned that it appeared to be taking longer to vet individuals.

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

© National Audit Office 2018

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.gsi.gov.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

006366 09/18 NAO

The National Audit Office study team consisted of:
Mark Bisset, Matt D’Oyly-Watkins, Helen Holden, Laura Scott and George Worlledge, under the direction of Lee Summerfield.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

What this investigation is about

1 National security vetting allows individuals access to government information, locations or equipment. In 2017-18, government considered more than 170,000 cases, including applications relating to civil servants, contractors and specialist staff such as those in the armed forces. The three most common categories of national security vetting are Counter Terrorist Check (CTC), Security Check (SC) and Developed Vetting (DV). DV is a more complex process requiring more checks. It allows individuals access to more-sensitive government information, locations or equipment than CTC or SC. Further information about the vetting categories, and the associated vetting processes is in Appendix Two.

2 Before 2017, most national security vetting in the UK was provided by two organisations: Defence Business Services National Security Vetting (DBS; part of the Ministry of Defence), and Foreign & Commonwealth Services National Security Vetting (FCOS; a trading fund of the Foreign & Commonwealth Office (FCO)).1 In its 2015 National Security Strategy and Strategic Defence and Security Review, government announced that it would establish a single vetting provider based on the Ministry of Defence (MoD) model.2 In January 2017, United Kingdom Security Vetting (UKSV) was created.

3 The Cabinet Office is responsible for vetting policy, and sets vetting standards that UKSV must follow. UKSV is responsible for providing vetting services.3 As its parent department, the MoD is responsible for the performance and oversight of UKSV.

4 During 2017, a number of UKSV’s customers became concerned that it appeared to be taking longer to vet individuals. Delays in vetting have the potential to impact government’s capacity and capability to conduct official business. This is particularly important at a time when:

government is managing a number of high-risk and high-profile projects, including exiting from the European Union;

the most recent National Security Risk Assessment considers the threats faced by the UK to have increased in scale, diversity and complexity;4 and

government security services are currently responding to a high threat of terrorism, and consider that the UK is a high-priority target for espionage, with significant and challenging cyber threats, which are often linked to physical and personnel threats.5

5 In January 2018 the FCO reported to the Foreign Affairs Select Committee that the formation of UKSV had significantly delayed vetting across departments, with a particular impact on the FCO.6 Some departments have started vetting individuals for DV roles at SC level first, so that the individual can work in a limited capacity consistent with their SC clearance, while their DV clearance is pending. The Home Office considers vetting delays to be a key risk to its ability to increase the number of Border Force staff to work on projects related to Brexit and the UK border.

6 The Cabinet Office is planning further reforms to national security vetting by 2019-20, provided UKSV performance has recovered. Future reforms are expected to include changes to the vetting process and IT systems, together with additional third-party checks.

7 We have undertaken an investigation into national security vetting. Our investigation considers:

government’s decision to centralise national security vetting services;

centralising national security vetting services;

resourcing UKSV;

UKSV’s performance; and

government’s response to UKSV’s performance.

8 This investigation does not assess whether the vetting process is effective through the security checks undertaken, nor evaluate whether UKSV provides value for money.

1 Some other organisations, such as police forces, conduct their own vetting. The vetting activities of these organisations are outside the scope of this investigation.

2 HM Government, National Security Strategy and Strategic Defence and Security Review 2015, Cm 9161, November 2015.

3 UKSV relies on third-party organisations to contribute information on individuals that is relevant to the vetting process.

4 The National Security Council prepared its first National Security Risk Assessment in 2010. This assessment is intended to inform strategic judgement, not to forecast every risk. The most recent assessment, in 2015, ranked domestic and overseas risks in three tiers according to judgements on likelihood and impact, with tier one risks representing the highest priority, based on high likelihood and/or high impact. The 2015 assessment included more tier one (and tier two) risks than the previous assessment.

5 Based on information published on the website of the Centre for the Protection of National Infrastructure, in July 2018.

6 For example, in the past the FCO has sought DV clearance for all its staff, given the sensitive information it handles and so that it can deploy staff flexibly across different countries and policy areas. Faced with delays in security vetting, it amended its policy in February 2018 to include considering whether SC clearance was sufficient for some roles.

Summary

Key findings

Government’s decision to centralise national security vetting services

1 In November 2015 government announced that it would establish a single vetting provider in 2016, but this decision was not supported by an assessment of the expected benefits, costs and risks. In 2010 the Cabinet Office told Defence Business Services National Security Vetting (DBS) and Foreign & Commonwealth Services National Security Vetting (FCOS) to consider establishing a single vetting service as soon as possible to drive efficiencies. Evaluations in 2011 by HM Treasury, and in 2013 by the Cabinet Office, reported that neither organisation was in a position to take on single vetting provider responsibilities. In November 2015, when the government announced it would establish a single vetting provider, it had not fully considered the expected benefits, costs and risks of doing this. In December 2016, the month before United Kingdom Security Vetting (UKSV) was established, DBS and FCOS had different funding models, key performance metrics and IT systems (paragraphs 1.1 to 1.7).

2 When government chose to base its single vetting provider on the Ministry of Defence (MoD) model (operated by DBS), DBS was not meeting all of its performance targets. In November 2015, when government announced it would establish a single vetting provider, DBS was completing more than 9 out of 10 Counter Terrorist Check (CTC) and Security Check (SC) cases on time. It was also completing fewer than 2 out of 10 Developed Vetting (DV) cases on time, below its target. In the same period, FCOS was meeting its performance targets for CTC, SC and DV cases on time (paragraph 1.9).7

Centralising national security vetting services

3 The risks associated with the merger of DBS and FCOS to create UKSV were consistently reported as high. The UKSV Programme Board, tasked with creating UKSV, first convened in March 2016. The Board considered that there was a high risk that UKSV would inherit an IT project that was under-resourced, under-funded and unplanned. The National Security Vetting Solution (NSVS) IT upgrade was intended to create a single system accessible to both DBS and FCOS by August 2016, ahead of the merger. UKSV was created in January 2017, four months later than expected, and without NSVS fully implemented across both of its sites (the former DBS and former FCOS sites) (paragraphs 1.6, 2.5 and 2.8).

4 When implemented by DBS in October 2016, NSVS resulted in automated checks failing and personal data attached to cases needing to be recovered. DBS upgraded to NSVS in October 2016, ahead of the merger with FCOS. In its first week, 10 out of 13 essential functions of NSVS did not work properly. During its first four weeks, nearly 8,500 files containing personal data (attached to cases) were unreadable when accessed, and 93% of automated checks against the police national computer failed.8 Officials had to reprocess failed checks manually, reload files and recover data, and conduct additional assurance checks.9 We estimate that the number of cases completed by DBS fell by 39% over the following quarter, and performance did not recover to previous completion rates until January 2017.10 UKSV delayed implementing NSVS at the former FCOS site until November 2017. At this time, all new cases used NSVS, but cases opened prior to this continue to be paper-based (paragraphs 2.6 to 2.9).

5 The delay in fully implementing NSVS meant that UKSV did not align its services or performance targets across its sites until April 2018. In 2017-18 the former DBS site completed almost 95,000 cases, and the former FCOS site almost 33,700 cases. Before April 2018, each site was delivering its existing products to existing customers, and measuring and reporting performance as it had done before the merger. Until the implementation of NSVS at the former FCOS site, UKSV collected and calculated performance data manually from paper-based records, and has been unable to provide complete and accurate information in relation to activity between January 2017 and March 2018. Performance targets were not aligned until April 2018, the point at which UKSV standardised its different products (paragraphs 2.8, 2.9, 3.1 and 3.2).

6 Cabinet Office considers that NSVS continues to experience issues relating to speed, costing customers £17 million per year. Cabinet Office estimates that the length of time taken to complete vetting cases has caused inefficiencies, costing UKSV customers £17 million per year.11 In May 2018, Cabinet Office began developing a replacement for NSVS. It plans for the replacement to be in place by January 2020 (paragraph 2.10).

Resourcing UKSV

7 UKSV calculates that it requires more resources than the two previous vetting organisations to meet demand. Since its launch, UKSV has operated in a state of recovery: recruiting additional staff and amending working practices to increase capacity and productivity. In February 2017, one month after it was established, UKSV calculated that it required 41 additional full-time equivalent staff to recover its performance. This increased its target full-time equivalent workforce from 519 to 560. In December 2017, UKSV completed an organisational review, and based on this it submitted a business case to MoD to increase its total workforce to 595, to fulfil its single vetting provider role as set out in the 2015 National Security Strategy and Strategic Defence and Security Review.12 In 2017-18, UKSV’s staff costs were £19 million. This was 17% higher (in 2017-18 prices) than the staff costs for the two previous vetting organisations in 2014-15 (paragraphs 2.11 to 2.13 and 2.19, and Figures 1 and 3).13

8 Resignations at UKSV have increased and it continues to rely on overtime and agency staff. In 2017-18 more than 70 UKSV staff resigned, which offset ongoing recruitment activity. Between January and March 2018, the number of full-time equivalent staff who resigned was nearly twice the number who resigned in the same period the previous year. By June 2018, UKSV had 96 fewer full-time equivalent staff than the 595 it considered it required. To fill its resource gaps UKSV uses overtime and temporary staff. In 2017-18 UKSV spent more than £0.5 million on overtime and temporary staff, or 3% of its staff costs for that year (paragraphs 2.16, 2.17 and 2.19, and Figures 2 and 3).

UKSV’s performance

9 UKSV customers can use a priority service where the need for clearance is urgent in order to conduct official business. Departments can prioritise 3% of all applications they sponsor in a year. Between January 2017 and July 2018, UKSV received nearly 7,000 priority cases, 3% of all the 277,000 cases received by UKSV during this period.14 Some 88% of priority applications were for CTC and SC, and 12% were for DV. UKSV has different targets for completing priority and non-priority cases (paragraphs 3.3 to 3.7, Figure 4).

10 UKSV has met its target for priority CTC and SC cases since August 2017. It has not met its target for priority DV cases since September 2017. Between January 2017 and July 2018, UKSV completed nearly 6,300 priority and just over 252,000 non-priority cases. UKSV aims to complete 95% of priority CTC and SC cases within ten days, and 95% of priority DV cases within 30 days. Since August 2017 it has met its monthly priority CTC and SC target by completing more than 9 out of 10 cases on time. UKSV last met its monthly target for priority DV cases in September 2017 (paragraphs 3.3 and 3.8, Figures 4 and 5).

11 UKSV first met its targets for completing non-priority CTC and SC cases in January 2018, one year after it was established. UKSV aims to complete 85% of non-priority CTC and SC cases within specified timeframes at each site.15 In its first month, UKSV completed just over 6 out of 10 non-priority cases on target. In February 2017, UKSV began working to recover performance of non-priority CTC and SC cases, but its performance declined further. By June 2017 it was completing just over 5 out of 10 non-priority CTC and SC cases on target. In January 2018, UKSV first met its non-priority CTC and SC targets, one year after it was established. It has maintained its performance relating to CTC and SC cases since then, and in July 2018, the most recent available data indicated that it was completing 9 out of 10 cases on target (paragraphs 3.6, 3.9 to 3.12 and Figure 6).

12 UKSV has not yet met its targets for completing non-priority DV cases, and does not expect to do so until the end of 2018. In March 2017, UKSV completed nearly 8 out of 10 non-priority DV cases on time, but this was below target and performance began to drop further from April 2017. Some of UKSV’s most important clients requested a DV recovery programme in September 2017, which was formally launched in February 2018.16 In March 2018, UKSV completed 2 out of 10 non-priority DV cases on target. As at July 2018, this has remained at 2 out of 10 completed on target. While UKSV predicts that it will achieve its non-priority DV performance target by the end of 2018, it is planning a further year of recovery activity (paragraphs 3.13, 3.17, 3.20 and Figure 6).

13 The total number of cases waiting to be completed increased continuously until August 2017. Between January 2017 (when UKSV was established) and August 2017, the total number of cases waiting to be completed increased from nearly 25,700 to more than 33,200. Nearly 26,700 of these open cases in August 2017 were CTC and SC cases. Between August and December 2017 the total number of all open cases declined to just over 22,300, but increased again to just over 25,600 by July 2018 (an increase of nearly 15%). The proportion of outstanding DV cases increased from 20% in January 2017 to nearly 24% in July 2018. While there are fewer DV cases, UKSV estimates that one DV case takes 32 times more effort to complete compared to one CTC or SC case (paragraphs 3.14 to 3.17 and Figure 7).

14 UKSV is failing to meet its performance targets for ‘aftercare’, which provides ongoing assurance about a vetted individual. An important function of vetting is to provide ongoing information and assurance to an employer when an individual’s circumstances change. This is known as aftercare, and can be scheduled or unscheduled.17 UKSV aims to complete 85% of scheduled and unscheduled aftercare checks on target. In 2017-18 UKSV failed to achieve its aftercare targets (paragraphs 3.21 to 3.22).

Government’s response to UKSV’s performance

15 UKSV has sought to improve its performance by repeatedly seeking increases to its resources and workforce; however, it has never succeeded in recruiting the number of staff it considers it needs. When it launched in January 2017, UKSV had a full-time equivalent workforce of 490 staff against an expected total workforce of 519. By February 2018, to address its poor performance, UKSV increased its overall staff requirement to 595 full-time equivalent staff. This was 13% more than the total number of vetting staff at DBS and FCOS before UKSV was created. Increasing staff numbers to this level is expected to cost an additional £3.5 million (gross) in 2018-19. UKSV’s staffing level has never exceeded 507 full-time equivalent staff (paragraphs 2.11 to 2.16 and Figure 1).

16 Following a review of UKSV’s performance, in January 2018 the Government Security Board agreed UKSV could change some of its processes temporarily. The Government Security Board agreed to proposals by UKSV to change some of its vetting processes in an attempt to help UKSV recover DV performance.18 These changes include allowing some interviews to be conducted over the telephone (rather than face to face) during 2018 and 2019; and postponing some DV renewal cases due in 2018 by one year (paragraph 3.19).

7 DBS and FCOS had different methods for measuring the length of time taken to complete a case. For example, DBS would begin recording time from the moment a case was received, irrespective of whether the application had been completed correctly or not. In comparison, FCOS would begin recording time only after all relevant information had been correctly submitted by the applicant.

8 The police national computer holds details of people who are, or were, of interest to UK law enforcement agencies because, for example, they have convictions for criminal offences.

9 Third-party organisations had attached 63 files directly to cases, and these could not be recovered and reloaded by UKSV.

10 This assumes that there were five working days in September and five in October during which cases were not processed, to account for a planned two-week IT outage to implement the NSVS IT upgrade. NSVS went live on 10 October 2016.

11 Estimated by Cabinet Office in its business case for further reforms to national security vetting, yet to be formally approved. This is currently the only estimate available for the inefficiencies caused by NSVS.

12 HM Government, National Security Strategy and Strategic Defence and Security Review 2015, Cm 9161, November 2015.

13 DBS was in a state of recovery between March 2015 and June 2016, and therefore 2014-15 has been chosen as the baseline for this comparison because it is the most recent financial year with data available during which DBS spent the least time in a state of recovery.

14 Data are incomplete and only include cases received through the NSVS system, which was not fully implemented on both sites until November 2017. UKSV is unable to provide complete data for priority cases until April 2018, at which point its services were standardised.

15 The way in which this is measured varied between sites. For example, one site measures time from the point at which the application is submitted on NSVS. The other site used to measure from the point at which an application was assigned to an official for processing (rather than the date the application is submitted), until NSVS was fully implemented.

16 Members of the Executive Customer Group include high-profile clients of UKSV who meet regularly and provide feedback.

17 Scheduled aftercare includes a planned review of an individual’s circumstances. Unscheduled aftercare is carried out reactively in response to an unforeseen event or change in circumstances (such as a significant lifestyle change) occurring after clearance has been issued.

18 The Government Security Board is a group consisting of the main customers of vetting services and the Cabinet Office.

Part One

Government’s decision to centralise national security vetting services

1.1 In November 2015, government announced in its National Security Strategy and Strategic Defence and Security Review (the SDSR) that it would establish a single provider of national security vetting services in 2016.19 This would be based on the Ministry of Defence (MoD) model. In 2015 most vetting was provided by two organisations: Defence Business Services National Security Vetting (DBS; part of the MoD), and Foreign & Commonwealth Services National Security Vetting (FCOS; a trading fund of the Foreign & Commonwealth Office (FCO)).20

Towards a single vetting provider

1.2 The government’s 2015 SDSR announcement followed a decade of work to move from a position where each department conducted its own vetting, to a single vetting provider. In 2007 the Cabinet Office established its Vetting Transformation Programme, and in 2008 it reduced the number of vetting providers to two: DBS and FCOS. In 2009 the Cabinet Office asked both to produce business cases setting out whether they could become the single provider of vetting services, and what benefits this would bring. In 2010 the Cabinet Office told both organisations to consider establishing a single vetting service as soon as possible to drive efficiencies, and in 2011 the Cabinet Office again asked both organisations to produce business cases. HM Treasury concluded in 2011 that neither DBS nor FCOS was in a position to take on the responsibilities of being the single provider of vetting services.

1.3 In 2013, a review commissioned by the Cabinet Office found that both DBS and FCOS were relatively immature organisations, and neither model was, at that time, appropriate for delivering a core (single) national security activity. It recommended that each organisation should continue to work separately, and that government should prioritise significantly improving the vetting process before creating any additional risks associated with organisational change. It also recommended that both organisations should put in place common performance metrics and an IT system that provides both organisations with the same information. These actions could support the government’s long-term aspiration to create a single vetting provider.

1.4 In February 2015 DBS and FCOS, as members of the Joint Steering Group on Vetting Reform, agreed a set of conditions that should be met before the government created a single vetting provider. The Cabinet Office accepted these conditions, which included migrating data to a new IT system, the accessibility of the new IT system to all staff, and changing pricing models. In October 2015 (the month before its publication), the Cabinet Office decided that the SDSR would include an irreversible commitment to create a single vetting provider, based either on the MoD model or as a joint venture between the two existing providers. The Prime Minister’s Military Assistant wrote to departments on 18 November 2015 indicating that the Prime Minister had agreed to the creation of a single vetting provider based on the MoD model.

1.5 When the government subsequently announced in the 2015 SDSR that it would establish a single vetting provider in 2016, it is not clear whether the conditions required to establish a single vetting provider had been met, and therefore whether government had fully assessed the expected benefits, costs and risks.

1.6 In 2016, the Defence Business Services chief executive officer created the UKSV Programme Board, which was tasked with establishing United Kingdom Security Vetting (UKSV) as the single vetting provider within the MoD. It first convened in March 2016, and planned a phased approach to achieving its objectives:

phase one: creating UKSV by September 2016, including transition of staff to the new organisation; and

phase two: unifying UKSV’s processes by April 2017, including ensuring that UKSV had a simplified catalogue, transparent prices, one billing system, new key performance indicators and a single structure after the merger of DBS and FCOS.

1.7 In December 2016, the month before UKSV was established, DBS and FCOS still had different funding models, key performance metrics and IT systems.

Selecting the MoD model

1.8 In the five years before the 2015 SDSR, the Cabinet Office considered a number of different options for a single vetting provider, including one based on FCOS, one based on DBS (within the MoD), and a joint venture between both organisations. In October 2015, the month before the SDSR was published, the Cabinet Office considered the following reasons to promote the MoD model, as it believed:

the MoD had the capability, and could readily increase its capacity;

the costs of security vetting could count towards the target to spend 2% of gross domestic product on defence;21 and

the MoD’s protected budget could assure that funding will be available for vetting.

1.9 When government announced its intention to base its single vetting provider on the MoD model, DBS processed around 91,000 CTC and SC, and 8,500 DV applications a year at one site. FCOS processed around 26,500 CTC and SC, and around 3,100 DV applications at another site. In November 2015, at the time of the announcement, DBS was completing more than 9 out of 10 CTC and SC cases on time, but fewer than 2 out of 10 DV cases on time. FCOS was meeting its performance targets for CTC, SC and DV cases.22

19 HM Government, National Security Strategy and Strategic Defence and Security Review 2015, Cm 9161, November 2015.

20 Some other organisations, such as police forces, conduct their own vetting. The vetting activities of these organisations are outside the scope of this investigation.

21 In July 2015 the government announced in its Summer Budget that it “…commits to meeting the properly measured NATO pledge to spend 2% of national income on defence every year of this decade”.

22 DBS and FCOS had different methods for measuring the length of time taken to complete a case. For example, DBS would begin recording time from the moment a case was received, irrespective of whether the application had been completed correctly or not. In comparison, FCOS would begin recording time only after all relevant information had been correctly submitted by the applicant.

Part Two

Centralising and resourcing national security vetting services

2.1 In 2016 the UKSV Programme Board repeatedly rated risks associated with merging Defence Business Services National Security Vetting (DBS) and Foreign & Commonwealth Services National Security Vetting (FCOS) as high. United Kingdom Security Vetting (UKSV) was created in January 2017, four months later than planned, bringing together vetting activity previously undertaken by DBS and FCOS under one organisation.

Establishing UKSV as a single vetting provider

2.2 The Ministry of Defence (MoD) prepared a business case for the creation of a single vetting provider based on the MoD model in September 2016. This was three months before the creation of UKSV in January 2017, and 10 months after the announcement to create a single vetting provider in the 2015 National Security Strategy and Strategic Defence and Security Review (the SDSR).23 The business case aimed to create a single vetting provider by merging FCOS with DBS at a one-off transition cost of £2.3 million. The final cost of the merger was £1.35 million. This was due to lower than estimated costs in a number of areas, including staff training.

2.3 In 2017-18, UKSV’s operating costs were £21.1 million. MoD planned to recover the costs of security vetting by charging customers for its services. It recovered £8.0 million of these through fees from clients (excluding MoD). The remaining £13.1 million was funded by MoD. In 2018-19, UKSV expects its operating costs to be £25.0 million, of which £8.2 million will be recovered through client fees, and £16.9 million will be funded by MoD.24

2.4 In April 2017 the Cabinet Office changed its vetting policy and introduced the Vetting Decision Framework, aimed at improving the quality of the vetting process. UKSV had to amend its processes accordingly. UKSV considers that these changes have led to standardised, but also far more substantial, vetting processes. For example, changes to the interview reporting process have increased the amount of time it takes to complete a DV case.

Implementing a single IT system for vetting

2.5 Government intended for there to be a single IT system, the National Security Vetting Solution (NSVS), accessible to both DBS and FCOS for vetting applications by August 2016. The UKSV Programme Board had repeatedly noted that the introduction of a single IT system was a major risk to the establishment of UKSV. It considered the project to be under-resourced, under-planned and underfunded. The implementation of NSVS at DBS was delayed from August to October 2016 because DBS did not complete system testing within the expected time. This delayed the establishment of UKSV from September 2016 to January 2017. NSVS was phased in at the former FCOS site from August 2017, with all new applications received on NSVS at the former FCOS site from November 2017.

2.6 In October 2016 DBS upgraded to NSVS at a cost of £14 million. In the first week following the implementation of the IT upgrade, 10 out of 13 of NSVS’s essential functions were having consistent or sporadic issues, some of which were having a major impact on UKSV’s normal operations. In its first four weeks, NSVS failed to store information and run automated checks correctly. At one point, 8,500 files containing personal data attached to cases were unreadable when accessed. Most of these files were recovered, of which 3,400 had to be manually reattached to their respective cases.25 In addition, 93% of automated checks against the police national computer failed.26

2.7 As a consequence of NSVS failures, officials had to re-process failed security checks manually, reload files, recover data, and conduct additional assurance checks. Between July and September 2016, DBS completed an average of 516 cases per day. DBS had planned a two-week IT outage, which ended in October 2016, while it implemented NSVS. Taking this into account, the number of cases DBS completed dropped 39% to an average of 313 cases per day between October and December.27 DBS returned to its pre-NSVS rate of cases completed in January 2017. By this time, the number of cases waiting to be completed had increased from around 17,600 in September 2016 to almost 22,000 (a 25% increase).

2.8 UKSV expected NSVS to be accessible to all staff from January 2017, including those working at the site formerly operated by FCOS. Due to the issues experienced by DBS, UKSV decided to delay implementation at the former FCOS site to mitigate the risk of de-stabilising that part of the organisation. NSVS was fully implemented at the former FCOS site in November 2017. The former FCOS site continued to use its existing paper-based application system up to this point. As a result, the former FCOS site continued to deliver its existing product set, to its existing customers, and measuring and reporting performance as it had previously done so, while part of FCOS, up until April 2018. At the point of the merger this meant that UKSV inherited 40 different agreements with approximately 120 different customer organisations.

2.9 As a heavily paper-based organisation, performance at this site was calculated manually and was based on existing reporting metrics, not comparable to the measures used at the former DBS site. UKSV was first able to report performance across both locations using NSVS in April 2018, 15 months after UKSV was created.

2.10 Cabinet Office considers that NSVS is still not meeting requirements in terms of its speed, and is contributing to inefficiencies across government. For example, Cabinet Office recently estimated that NSVS has caused inefficiencies costing £17 million each year in relation to recruiting and vetting for government projects.28 In May 2018, Cabinet Office began developing a replacement system for NSVS, which it plans to be in place by January 2020.

Resourcing UKSV

UKSV’s workforce requirements

2.11 Since its launch, UKSV has operated in a state of recovery, recruiting additional staff in an attempt to increase capacity. Before UKSV was created there were 519 full-time equivalent staff working in national security vetting: 397 at DBS,29 and 122 at FCOS. When the merger took place in January 2017, 490 full-time equivalent staff transferred into UKSV, 389 from DBS and 101 from FCOS. By February 2017, UKSV reported that its total full-time equivalent workforce was 484, 7% less than the target workforce of 519 it had expected.

2.12 In February 2017, UKSV determined that in order to fulfil its role as single vetting provider and improve its performance, it needed to increase its overall workforce from 519 full-time equivalent posts to 560 at an additional cost of £1.9 million. MoD approved in principle to increase UKSV’s headcount, but did not provide funding on the basis that UKSV never filled its posts to either the 519 or 560 target levels due to high levels of staff attrition (see Figure 1 and Figure 2).

2.13 In December 2017 senior managers at UKSV completed an organisational review. The review concluded that even if UKSV recruited to its target of 560 full-time equivalent staff, it would still not have the capacity and capability to meet current or future demand.30 The review recognised UKSV’s resourcing model as a significant contributing factor to the organisation’s challenges.

2.14 Based on this review, UKSV submitted a business case to MoD in December 2017 seeking to increase its total workforce to 595 full-time equivalent staff. This is expected to have a gross cost of £3.5 million in 2018-19, and an annual gross cost of £3.2 million each year thereafter. UKSV acknowledged that recruiting, inducting and training new staff would result in a further short-term loss in productivity. The MoD approved this increase in April 2018, and made funding available.

2.15 In January 2018 UKSV submitted another business case targeted at improving its performance in completing Developed Vetting (DV) cases. This business case sought approval to bring forward the recruitment of five of the new staff requested in the December 2017 business case. UKSV also requested approval for a package of short-term measures at an additional cost of £1.7 million. These included:

recruiting 30 temporary staff;

temporarily promoting four existing UKSV staff;

continuing to employ up to nine retired vetting officers; and

using overtime in 2018-19.

The MoD agreed to these measures in February 2018.

Recruitment and retention

2.16 UKSV has never had more than 507 full-time equivalent staff, even though the MoD agreed in April 2018 that it could increase its overall workforce to 595 to recover its performance. As at June 2018, UKSV had 499 full-time equivalent staff, 96 fewer full-time equivalent staff than the 595 it considered it required.

2.17 During 2017-18, more than 70 UKSV staff resigned, which offset ongoing recruitment activity. Between January and March 2018, the number of full-time equivalent staff who resigned was nearly twice the number who resigned in the same period the previous year (see Figure 2).

2.18 Most of the staff who resigned were case assessors and vetting officers.31 This has had a particular impact on DV, for which all cases require at least three interviews by a vetting officer. Between March 2017 and March 2018, UKSV decreased its vetting officer workforce by 10 net full-time equivalents. It takes more than seven months, and costs approximately £23,000, to hire, vet and train one replacement vetting officer.32

Escalating staff costs

2.19 In 2017-18 UKSV’s staff costs were £19 million. This was 17% more than the combined staff costs of DBS and FCOS in 2014-15 (see Figure 3).33 UKSV spent more than £0.5 million (3%) of its £19 million staff costs on overtime and temporary staff. It relied on overtime, temporary staff and contracting former retired staff to fill vacant posts and maintain its service.34 UKSV forecasts that its staff costs will rise to £21.9 million in 2018-19 as part of its goal of increasing its full-time equivalent workforce to 595.

23 HM Government, National Security Strategy and Strategic Defence and Security Review 2015, Cm 9161, November 2015.

24 Figures may not sum exactly due to rounding.

25 Third-party organisations had attached 63 files directly to cases, and these could not be recovered by UKSV.

26 The police national computer holds details of people who are, or were, of interest to UK law enforcement agencies because, for example, they have convictions for criminal offences.

27 This assumes that there were five working days during both September and October in which cases were not processed to account for a planned two-week IT outage to implement the NSVS IT upgrade. NSVS went live on 10 October 2017.

28 Estimated by Cabinet Office in its business case for further reforms to national security vetting, yet to be formally approved. This is currently the only estimate available for the inefficiencies caused by NSVS.

29 Made up of 395 from Defence Business Services National Security Vetting (part of Defence Business Services), and two from Defence Business Services.

30 UKSV forecasts demand to increase by 6% between 2017-18 and 2018-19, primarily as a result of increases in annual British Army demand for Counter Terrorist Check vetting.

31 A case assessor processes information. A vetting officer conducts interviews as part of the process for all DV cases, and some SC cases (see Figure 6 in Appendix Two).

32 This excludes some recruitment costs, which UKSV has not captured.

33 DBS was in a state of recovery between March 2015 and June 2016, and therefore 2014-15 has been chosen as the baseline for this comparison because it is the most recent financial year during which DBS spent the least time in a state of recovery.

34 In addition, one third-party provider typically processes 1,200 cases during the week and between 1,500 and 2,000 cases at weekends using overtime.

Part Three

UKSV’s performance

3.1 United Kingdom Security Vetting (UKSV) is responsible for providing vetting services in accordance with vetting standards set by the Cabinet Office. UKSV measures its performance based on the time it takes to process applications. Between January 2017 and March 2018, UKSV’s two sites measured performance in different, incompatible ways. Until April 2018, at the former Defence Business Services National Security Vetting (DBS) site, cases were measured from the point at which they were received, irrespective of whether the application had been completed correctly or not. In comparison, at the former Foreign & Commonwealth Services National Security Vetting (FCOS) site, cases were measured as starting once all relevant information had been correctly submitted by the applicant. Performance targets were not aligned until April 2018, the point at which UKSV standardised its different products.

3.2 UKSV has had difficulty in providing us with data on performance against targets from the former FCOS site from the point at which it was merged with DBS until April 2018. UKSV told us that as a heavily paper-based site, performance at the former FCOS site was calculated manually rather than via an automated process until November 2017, when UKSV fully implemented the National Security Vetting Solution (NSVS) IT system across both sites. Our analysis of UKSV performance between January 2017 and March 2018 is based on data that UKSV has been able to provide from the NSVS system at one site as well as incomplete data it holds on performance of the former FCOS site during this period, which it has collated manually for the purposes of this investigation. From April 2018, UKSV has reported its performance on a consistent basis across both sites. We report here the proportion of cases that met the different targets that existed across UKSV, regardless of how each target was measured.

3.3 UKSV customers can use a priority service where the need for clearance is urgent in order to conduct official business. Departments can prioritise 3% of applications they sponsor in a year. Since it was created UKSV has completed more than 258,000 cases, of which nearly 6,300 (2%) were priority and just over 252,000 (98%) were non-priority (see Figure 4).

3.4 From November 2016, FCOS provided an additional fast-track service within its priority service to the Department for Exiting the European Union to expedite Brexit-related cases. UKSV continues to offer this, and from July 2017 this fast-track service was extended to four other government departments with specific roles in support of the UK’s exit from the EU.35 This service was expanded again in January 2018 to also include the Home Office. Between July 2017 and July 2018, UKSV completed 1,056 cases under this service.

UKSV’s performance targets

3.5 UKSV has different targets for completing priority and non-priority cases. UKSV customers can identify a limited number of the applications they sponsor, which UKSV prioritises over other work.

3.6 UKSV performance targets are:

95 per cent of priority cases within:36

10 days for CTC and SC cases;37 and

30 days for DV cases.

85 per cent of non-priority cases within:

25 days for CTC and SC cases; and

80 or 95 days for DV cases.38

3.7 Between January 2017 and July 2018, UKSV received nearly 7,000 priority cases, 3% of all the 277,000 cases received by UKSV during this period (see Figure 4).39 Some 88% of priority applications were for CTC and SC, and 12% were for DV. The average number of priority applications received by UKSV each month has increased 148% during this period.40

3.8 Since January 2017 UKSV has met its monthly performance targets for all priority cases:

14 months out of 19, including every month from August 2017 to July 2018 for CTC and SC cases; and

four months out of 19 for DV cases (see Figure 5).

Within the priority CTC and SC cases, UKSV also has an additional target of completing 85% of Brexit fast-track cases within seven days, which UKSV has consistently met since August 2017.

Performance of non-priority cases

3.9 Between January 2017 and July 2018, UKSV received more than 277,000 non-priority applications, 97% of all the cases received by UKSV during this period. Some 91% of non-priority applications were for CTC and SC, and 9% were for DV. The average number of non-priority applications received by UKSV each month has decreased by 8% during this period.41

CTC and SC performance

3.10 In January 2017, in its first month of operation, UKSV completed just over 6 out of 10 CTC and SC cases on target. Within six months, its performance against these targets had fallen, and it was completing just over 5 out of 10 cases on target (see Figure 6).

3.11 In February 2017 UKSV began working on a recovery programme targeting CTC and SC cases. In November its performance started to improve. In addition to increasing the resources available to process cases, UKSV made minor changes to the SC process, such as reducing the volume of notes required to support a case. The Ministry of Defence (MoD) also gave it permission not to process cases based on their age.42

3.12 UKSV first met its targets for non-priority CTC and SC cases in January 2018, 12 months after it was established. It has maintained its performance relating to CTC and SC cases since then and, in July 2018, the most recent available data indicated that it was completing 9 out of 10 cases on target.

DV performance

3.13 UKSV has never met its DV target. In March 2017 UKSV’s performance in relation to DV cases peaked at nearly 8 out of 10 cases completed on target; however, this was nevertheless short of its target.43 Since March 2017, its performance in relation to DV cases has fallen and, by March 2018, it was completing 2 out of 10 cases on target. As at July 2018, the most recent data available, this had remained at 2 out of 10 completed on target (see Figure 6).

Number of open cases

3.14 The number of open cases is a combination of new cases received and cases that have not yet been completed. In January 2017, UKSV had nearly 25,700 open cases consisting of around 20,500 CTC and SC cases, and around 5,150 DV cases. At July 2018, UKSV had just over 25,600 open cases, of which more than 19,500 (76%) were CTC and SC cases and nearly 6,100 (24%) were DV cases (see Figure 7).

3.15 The number of open CTC and SC cases increased every month until August 2017, when UKSV had nearly 26,700 CTC and SC cases waiting to be processed. By September 2017 the number of open CTC and SC cases started to decrease. By December 2017, the month with the fewest open cases, the number of open CTC and SC cases was just over 15,600, a decrease of 41% in four months. Since December 2017, the number of CTC and SC cases has increased again, and as at July 2018 there were more than 19,500 cases waiting to be completed.

3.16 UKSV estimates that one DV case takes 32 times more effort to complete than one CTC or SC case. The proportion of open cases that are DV has increased from 20% in January 2017 to 24% in July 2018. As at July 2018, UKSV had nearly 6,100 DV cases waiting to be completed, an increase of nearly 18% compared to January 2017.

3.17 In September 2017, when UKSV had nearly 6,700 open DV cases, UKSV’s Executive Customer Group requested a DV performance recovery programme from UKSV.44 As an interim measure, UKSV employed temporary agency staff, along with nine former (retired) vetting officers on short-term contracts. UKSV also made changes to the DV process by the end of 2017 that included removing the requirement that a single vetting officer conduct all interviews associated with one case, and asking interviewees to travel to the vetting officer rather than vice versa.

3.18 In January 2018, UKSV produced a business case targeting its performance in completing DV cases, and the overall number of cases waiting to be completed. The business case included recruiting additional vetting officers. It identified a risk of significant reputational damage to the MoD if it did not take corrective action immediately. In February 2018 UKSV launched a DV recovery programme. At this time, MoD police officers were also redeployed to help with DV recovery programme operations.

3.19 In January 2018, the growing number of DV cases waiting to be completed caused the Government Security Board to agree temporary changes to the vetting process to help UKSV to recover.45 The changes were:

postponing some DV renewal cases due in 2018 (except for particularly sensitive posts and for individuals whose circumstances have changed);46 and

allowing some interviews to be conducted over the phone during 2018 and 2019.47

3.20 UKSV hoped that the effect of these changes would prevent the number of DV cases waiting to be completed from increasing beyond August 2018. In February 2018, when UKSV launched its DV recovery programme, it had around 7,350 open DV cases. This reduced to nearly 6,100 by July 2018. While UKSV predicts that it will achieve its DV performance target by the end of 2018, it is planning a further year of recovery activity as it processes postponed DV renewal cases.

Providing ongoing assurance

3.21 Cabinet Office policy is that national security vetting should only be considered as a snapshot of an individual and their circumstances at the point when an assessment is carried out. While individuals who have been vetted continue to work with access to sensitive information, locations or equipment, the policy highlights the importance of putting in place careful personnel security management arrangements to continue to provide assurance about an individual. The process through which this ongoing assurance is provided is referred to as aftercare.

3.22 Aftercare can be scheduled, for example as a planned review of an individual’s circumstances, or unscheduled, which is reactive and responds to an unforeseen event or change in circumstances. UKSV aims to complete 85% of scheduled and unscheduled aftercare checks on target. In 2017-18 UKSV failed to achieve its aftercare targets.

35 In July 2017 the service was extended to also include the Department for Business, Energy, Innovation & Skills, the Department for International Trade, the Department for Environment, Food & Rural Affairs, and the Department for Digital, Culture, Media & Sport.

36 Priority cases include Brexit fast-tracked cases, and applications that a sponsor chooses to fast-track (a sponsor can prioritise a maximum of 3% of applications in a year).

37 Brexit fast-track cases are treated as priority cases, and must meet the priority case targets. UKSV also has an additional target of completing 85% of Brexit fast-track cases within seven days.

38 This only includes days on which UKSV is actively working on a case. These timeframes exclude periods when officials cannot work on cases because of delays that are outside UKSV’s control. Such delays could be caused by, for example, applicants not submitting sufficient information with their application, or by UKSV waiting for information from a third-party organisation involved in the vetting process.

39 Data are incomplete and only include cases received through the NSVS system, which was not fully implemented on both sites until November 2017. UKSV is unable to provide complete data for priority cases until April 2018, at which point its services were standardised.

40 This is calculated using a three-month rolling average of all priority cases received each month between January 2017 and July 2018. The average number of priority cases received by UKSV between January 2017 and March 2017 was 216 and between May 2018 and July 2018 was 536.

41 This is calculated using a three-month rolling average of all non-priority cases received each month between January 2017 and July 2018. The average number of non-priority cases received by UKSV between January 2017 and March 2017 was 15,648 and between May 2018 and July 2018 was 14,354.

42 This provides UKSV with the opportunity to deprioritise complex and time-consuming cases.

43 It should be noted that the length of time it takes to complete a DV case means that most of the work for cases completed in January 2017 would have been conducted by the two previous vetting organisations: DBS and FCOS.

44 The Executive Customer Group includes a number of high-profile clients of UKSV who meet regularly and provide feedback on UKSV’s performance.

45 The Government Security Board is a group consisting of the main customers of vetting services and the Cabinet Office.

46 This is estimated to affect approximately 2,600 cases.

47 Interviews have traditionally been conducted face to face.

Appendix One

Our investigative approach

Scope

1 In January 2017, the government centralised its national security vetting services and created United Kingdom Security Vetting (UKSV). During 2017, a number of UKSV’s customers became concerned that it appeared to be taking longer to vet individuals. We conducted an investigation into the creation, resourcing, and performance of UKSV.

2 We have undertaken an investigation into national security vetting. Our investigation considers:

government’s decision to centralise national security vetting services;

centralising national security vetting services;

resourcing UKSV;

UKSV’s performance; and

government’s response to UKSV’s performance.

3 This investigation does not assess whether the vetting process is effective through the security checks undertaken, nor evaluate whether UKSV provides value for money.

Methods

4 In examining the issues in paragraph two, we drew on a variety of evidence sources. We:

interviewed working level officials and senior officials in UKSV, Ministry of Defence, Defence Business Services, Home Office, Foreign & Commonwealth Office, Department for Exiting the European Union, and Cabinet Office;

examined business cases and internal reviews in relation to the merging of FCOS and DBS;

examined the Cabinet Office draft business case for further reforms to national security vetting;

examined documents relating to the creation and resourcing of UKSV; and

collated and analysed data on UKSV’s performance and costs.

5 UKSV has had difficulty in providing us with data on performance against targets from the former FCOS site from the point at which it was merged with DBS until April 2018. UKSV told us that as a heavily paper-based site, performance at the former FCOS site was calculated manually rather than via an automated process until November 2017, when UKSV fully implemented the National Security Vetting Solution (NSVS) IT system across both sites. Our analysis of UKSV performance between January 2017 and March 2018 is based on data that UKSV has been able to provide from the NSVS system at one site as well as incomplete data it holds on performance of the former FCOS site during this period, which it has collated manually for the purposes of this investigation.

6 Using the data provided to us, we carried out analysis of performance data from UKSV, and its predecessor organisations: Defence Business Services National Security Vetting, and Foreign & Commonwealth Services National Security Vetting. We were sent performance data from UKSV in a number of batches, and in a number of formats for each of its two sites separately. Our aim was to identify trends and report monthly performance and caseload statistics from all government customers for Counter Terrorist Check (CTC) and Security Check (SC) combined, and Developed Vetting (DV).

7 UKSV measured performance differently at each of its two sites. The point in time when an application was considered as received differed between each site. It was not therefore possible to directly compare the performance data of each site. The performance metrics in this report uses the total number of cases that were completed to target each month across both sites, and presents them as a proportion of the total number of cases completed across both sites each month. This does not account for the length of time that an application has taken to complete, but instead indicates the proportion of completed cases that met their target across UKSV irrespective of what that target is.

8 In order to carry out this analysis, we first consolidated the various data files into a single database that showed monthly caseloads and performance. The data contained break downs by service offering, and level of security clearance. For example. To produce statistics on performance at each level of security clearance for all government customers our analysis consolidated the performance for each service offering, at each level of security clearance, to produce monthly statistics on performance, total completed cases, total received applications, and total open cases for all priority and non-priority DV applications and all priority and non-priority CTC and SC applications.

Appendix Two

A simplified version of the national security vetting process, and categories of national security vetting

Design and Production by NAO External Relations
DP Ref: 006366-001