Report

by the Comptroller
and Auditor General

Department for Environment, Food & Rural Affairs

Progress in Implementing EU Exit

HC 1498 Session 2017–2019 12 September 2018

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund, nationally and locally, have used their resources efficiently, effectively, and with economy. The C&AG does this through a range of outputs including value-for-money reports on matters of public interest; investigations to establish the underlying facts in circumstances where concerns have been raised by others or observed through our wider work; landscape reviews to aid transparency; and good-practice guides. Our work ensures that those responsible for the use of public money are held to account and helps government to improve public services, leading to audited savings of £741 million in 2017.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 11 September 2018

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

10 September 2018

This report is part of the National Audit Office’s (NAO’s) ongoing programme of work across government to examine how government is organising itself to deliver a successful exit from the EU. In this report we set out what the Department for Environment, Food & Rural Affairs (Defra) has done so far to prepare for EU exit, and assess whether sufficient progress has been made.

© National Audit Office 2018

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.gsi.gov.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

006328 09/18 NAO

The National Audit Office study team consisted of:
Richard Davis, Stephanie Woodrow, Yvonne Gallagher under the direction of Keith Davis.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

Key facts

Summary

Introduction

1 In March 2019, the UK is set to leave the EU. The Department for Environment, Food & Rural Affairs (Defra) is one of the government departments most affected by EU Exit.

2 Defra’s portfolio is very varied, covering the chemical and agri-food industries as well as crucial policy areas such as agriculture, fisheries and the environment. In common with other government departments, it has organised its portfolio into individual ‘work streams’. With 55 work streams and 4 cross-cutting and co-ordinating activities, it has the second largest number of work streams of any department. In addition, it has to draft a large volume of legislation, contribute to the government’s negotiations and work closely with the devolved administrations.

3 Following the March 2018 Council of the European Commission, Defra changed the focus of its EU Exit planning to take account of the implementation period that was agreed at that meeting. For many of its work streams, Defra put its contingency plans for a no-deal scenario on hold, while increasing contingency where there is a risk to life, health or security. It is now organising its preparations around a range of different scenarios, including exit without a deal in March 2019, and a negotiated exit with an implementation period lasting until the end of 2020.

Scope of this report

4 In December 2017, we published a briefing on how Defra was preparing for the UK’s departure from the EU.1 The briefing set out the scale of Defra’s task, the governance structures set up to manage the task, and how Defra was working with its stakeholders, businesses and the devolved administrations. This report assesses the progress Defra has made since our previous report based on analysis we carried out between March and May 2018. As well as looking at how Defra is managing its overall portfolio, we have carried out a detailed analysis of progress on four of its work streams (Figure 7). These work streams were selected to cover the range of changes Defra must make, including establishing new regulatory functions and services, changes to its business practices and processes, developing supporting IT systems and working with third parties.

5 In April 2018, Defra began a comprehensive review of its portfolio that has resulted in an increase in the number of work streams2 for which it is responsible from 43 to 64. The number has since fallen to 55 as two work streams are closed and seven have been rolled into others. This report is based on the 43 original work streams in place until May 2018 because Defra’s portfolio was in transition during our analysis. Our study methods are set out in more detail in Appendices One and Two.

Recent developments

6 Since our report in December 2017, Defra has:

reviewed its portfolio to capture the full breadth of its EU Exit work, including its longer-term post-EU Exit activity. The portfolio includes 12 work streams covering cross-cutting areas such as devolution, legislation and estates and two coordinating work streams covering other government departments and arm’s-length bodies (Figure 1). The work streams are listed in Appendix Three.

reviewed the need for IT and digital developments in order to reduce demands on the Data, Digital and Technology Services division that delivers Defra’s IT developments. This has resulted in the number of work streams with an IT component falling from 20 to 14 as at March 2018; in July 2018, this was further reduced to 11 as a result of the amalgamation of four of its work streams.

met its target of recruiting 1,300 new staff to its EU Exit programme by March 2018 (1,182 staff were in post and the remainder were progressing through the pre-employment stages).

submitted a bid for funding for 2018-19 to HM Treasury and received approval for spending of £320 million, approximately two-thirds of what was initially requested. Of this, £10 million will come from Defra’s existing resources. Defra told us that it reduced its original bid during discussion with HM Treasury, and agreed that the final total was sufficient for its needs.

introduced a new EU Exit Delivery Group bringing together the existing EU Exit Overview team, the Programme Management Office (PMO), the legislation and devolution teams and the EU and International trade team. It is headed by a new Director General.

changed its governance structure to strengthen project management, creating two additional policy director roles to balance workloads and respond to the demands of EU Exit, and reinforcing project and programme management capabilities in the individual work streams.

published a consultation, ‘Health and harmony: the future for food, farming and the environment’, in February 2018, setting out its proposals for agriculture policy in England following EU Exit, and a white paper on fisheries, ‘Sustainable fisheries for future generations’, in July 2018.

Key findings

The scale of the Defra’s task

7 Defra has achieved a great deal in difficult circumstances and to a very demanding timescale. To prepare for EU Exit, it has drawn up detailed plans for most of its work streams, designed and started to build new IT systems and functions, managed a rapid expansion in its workforce and started to prepare the huge volume of legislation needed to ensure a functioning statute book. The constantly changing environment that Defra is working in, in particular the fluctuations in the likelihood of reaching a deal, has made it difficult for Defra to make, and stick to, a robust plan. Because of the scale of its challenge, Defra needs to make major changes to the size and structure of its organisation as it begins to provide the services and functions that will replace those currently provided by the EU (paragraphs 1.2 to 1.4).

Overall progress in delivering its work streams

8 Defra’s plans for its individual work streams are improving, but many are of poor quality and lack maturity. By April 2018, Defra had developed detailed plans for 35 of its 43 work streams. However, it rated only six of these as complying fully with its planning standards.3 Defra is currently undertaking a further re-planning exercise in the light of a likely implementation period and the increase in the number of work streams to 55. It had new plans in place for 12 work streams by the end of June 2018. It is continuing to develop its plans for the remainder but does not expect to complete its work until September 2018 (paragraphs 2.3, 2.5 and Figure 4).

9 Defra has missed a high proportion of its project milestones. The EU Exit PMO reported to the Portfolio Board in March 2018 that, in its plans for a no-deal exit in March 2019, as many project milestones had been missed as had been met. From early February to early April 2018, 39% of milestones across the portfolio had been pushed back with an average delay of seven weeks. Defra attributes its missed milestones to its original plans being optimistic and based on planning assumptions that later proved incorrect. Until May 2018, the PMO reported on numbers of missed milestones but not on the consequences of these missed and delayed milestones, making it difficult in our view to reliably assess progress across the portfolio. From May 2018, the PMO started to collect the detailed information on missed milestones, their causes and the mitigating actions required to get back on track. The new reporting process also identifies key risks and issues at both portfolio and project levels (paragraph 2.4).

10 The risk of Defra not delivering all its EU Exit portfolio in a no-deal scenario is high and, until recently, not well understood. The PMO reported to the Portfolio Board in April 2018 that, under a no-deal exit in March 2019, “while many of the individual work streams may be deliverable, the overall complexity and aggregate risk in the portfolio make it unstable”. The number of its work streams with an overall risk rating of red or amber has remained almost constant (at around 30 out of 43) since the start of 2018. However, other indicators showed a steep increase in reported risk levels across the portfolio from March to April 2018, which Defra attributes to an improved and more consistent approach to assessing risk (paragraphs 2.7, 2.8 and Figure 5).

11 In a no deal scenario, there is a high risk that Defra will be unable to deliver all the Statutory Instruments (SIs) it needs in time and it is identifying those that it needs to prioritise. It is preparing three new bills for EU Exit (on agriculture, fisheries, and environmental principles and governance). It also needs 93 SIs to complete the conversion of EU law into UK law at the point of exit. This is in addition to an estimated 58 SIs needed for non-EU business, bringing the total expected for 2018 to 151. This is more than double the average of 75 SIs in the eight years to 2017. In June 2018, Defra’s legislation team reported to the Programme Board that “Defra is at a high risk of being unable to deliver a full and functioning statute book by end March 2019” and in July 2018 its secondary legislation programme was rated as red. By June 2018, the team had completed a first draft of 33 of the 93 (35%) EU Exit SIs it needs but 37% were either not started or less than halfway to a completed draft. Defra is concerned about the shortage of parliamentary time available and is trying to minimise the number of non-EU Exit SIs needed, for example by considering which ones can be delayed beyond March 2019. Defra had aimed to complete all its EU Exit SIs by December 2018, but has now revised its plans to allow some to slip into the first quarter of 2019 (paragraphs 2.28, 2.29 and Figure 9).

12 For some work streams, Defra has passed the point where it will be able to deliver what it had initially planned for a ‘no-deal’ exit in March 2019 but it continues to review and update its plans with the aim of having sufficient arrangements in place if no deal is agreed. Defra has adjusted its focus towards planning for a range of different scenarios, including exit without a deal in March 2019, and a negotiated exit with an implementation period lasting until the end of 2020. However, it still needs to identify and manage the risks arising from not being fully prepared. In the work streams we examined, we found examples where Defra would not be fully ready for the ‘no-deal’ scenario and needed to make decisions about whether to accept the resulting risk or to plan contingency action:

Defra is still developing its plans to strengthen its control and enforcement activities in English fishing waters. Defra’s preferred option is to significantly increase the number of vessel patrol hours but HM Treasury will not agree to full funding requirements until Defra has submitted its full business case, which it is currently developing. In its outline business case, submitted in August 2018, Defra estimated that it would take eight months to procure and implement a contract to provide the control and enforcement needed, and therefore may have to scale up its patrolling capacity over time following EU Exit. As a result, in a no-deal scenario, Defra will not reach its preferred level of control and enforcement capacity by March 2019, but told us it is confident that it will be able to manage the risk of any disruption in the interim.

Defra needs to negotiate with 154 non-EU countries to agree acceptance of UK versions of over 1,400 export health certificates. It is focusing on reaching agreement with 15 of these countries that it estimates account for approximately 90% of total exports to non-EU countries of animal products, food and live animals, but is not expecting to be able to complete negotiations with all the remaining 139 countries by March 2019. Defra has accepted the risk that firms that currently export to those countries where agreement is not reached may not be able to do so for a period after EU Exit.

Without a significant increase in the UK’s veterinary capacity, Defra will be unable to process the increased volume of export health certificates it expects if there is no deal. To achieve the required capacity, Defra needed to provide the market with sufficient notice and certainty about the scale of the increased capacity required. It had programmed this work to start in April 2018 but, by September 2018, the government had not yet authorised Defra to start engaging publicly with the veterinary market. If there are not enough vets, consignments of food could be delayed at the border or prevented from leaving the UK. If there is still a significant likelihood of no deal being reached in October 2018, Defra is planning to launch an emergency recruitment campaign to bring capacity at least part-way towards the minimum level required. Defra told us it is confident that it will be able to fill any remaining gaps, for example through the use of non-veterinararians to check records and processes that do not require veterinary judgment (paragraphs 2.20, 2.21 and 2.23 to 2.26).

Managing the portfolio

13 Defra does not have a clear vision either for the new services and functions it has to introduce or for the organisation as a whole post-EU Exit, and it therefore has limited understanding of future costs. The Defra group as a whole is already changing significantly and will have to change further as it prepares to deliver new services and functions. Although not knowing the terms of the UK’s exit makes this more difficult, Defra needs to consider how EU Exit affects its organisational strategy and future vision. It has not yet adapted its target operating model for the group as a whole post-EU Exit or developed detailed target operating models for each of the major new services and functions, such as managing food imports and exports and a new chemical regulatory function, that it will take on. Given the time imperative, Defra has until recently focused on putting in place the IT systems it needs for March 2019 if there is no deal, but consideration of what the full services will look like and how they will be managed is also urgent. The costs of some of the work streams we examined are not yet fully developed. Defra is developing detailed estimates of resourcing and IT costs for implementing the UK’s chemical regulatory regime and control and enforcement activities in English fishing waters in a no-deal scenario. However, the full operational costs have not yet been firmly established and full business cases have yet to be submitted to HM Treasury (paragraphs 1.15, 1.16, 2.10, 2.23 and Figure 8).

14 Because it has not fully defined its future service requirements, Defra has not yet ensured that the new IT systems it is developing can meet future operational capability, as specified in its outline business cases. In its outline business cases for the chemical regulation and import control systems, Defra set out its preferred option of achieving a minimum operating capacity ready for March 2019, with systems that would enable enhanced functionality to be developed in the longer term. Defra has been focusing on ensuring that a functioning system is in place for a potential exit without a deal in March 2019. However, the approach it is taking means there is a risk that these solutions may not be able to deliver the enhanced capability needed once it has specified the full business requirements, and that the basic design and build may need significant rework as a result (paragraphs 2.12, 2.13 and 2.16).

15 In April 2018, Defra began an exercise to review at a portfolio level its contingency plans for a no-deal exit in March 2019. For each work stream, it assessed the impact of not delivering the minimum capability by March 2019. Some work streams, such as environmental governance, were excluded from the exercise because Defra had not been planning to have new arrangements in place by March 2019. In other cases, it was already too late, for example to establish new border inspection posts for food imports. For the rest, Defra mapped the impact (in terms of cost, national security and government reputation) against the benefits it would gain, for example from freeing up scarce capability or avoiding public concern. It then used this to decide for each work stream whether to pause no-deal preparations, reduce them or carry on in full. We regard this as a sensible approach that should help Defra to release some capacity and thus improve its chances of delivering the highest priorities. In order to make fully informed decisions about its priorities, it now needs to assess the aggregate impact on sectors that are affected by multiple work streams (paragraphs 1.12 to 1.14).

16 There is a risk of disruption to the UK’s chemical manufacturing industry that Defra cannot address on its own. The UK exported chemicals and chemical products to the value of £28.3 billion in 2017, of which £17.0 billion (60%) was to other EU member states. The UK’s position, as set out in the July 2018 white paper on the future relationship between the UK and the EU, is to seek continued participation in the European Chemicals Agency and to ensure that UK businesses can continue to register chemical substances directly, rather than working through an EU-based representative. However, this is dependent on a negotiated settlement. Without this, UK chemical manufacturers would no longer be able to export their products to EU member states because registrations of products with the EU would cease to be recognised by the EU. To recover market access, they would need to re-register their products on the EU’s system via an affiliate or representative located in an EU member state. This is a lengthy process that cannot be started until the UK has left the EU (paragraphs 2.10 and 2.11).

17 Defra has not been able to make progress in supporting business in their preparations. While Defra has been able to engage informally and on a one-to-one basis with key business groups and trade associations on preparations for a no-deal scenario, government restrictions communicated through DExEU have prevented more open consultations with a wider pool of stakeholders or the issue of material about the implications of readiness on UK government websites. Defra has repeatedly escalated its concerns to DExEU over restrictions on stakeholder communications but some restrictions remain in place. Defra’s webpage on how to comply with EU regulations on using, making, selling or importing chemicals contains no reference at all to EU Exit or any potential changes following EU Exit. In July 2018, Defra was permitted to publish a statement on the implications of an implementation period on the chemicals industry. Prior to this, stakeholders had to look to the European Commission or the EU agencies for public reference material. Similarly, there is no guidance on Defra’s website for businesses exporting food products to the EU. Some of these may have to apply for an export health certificate for the first time and change trading routes so that their products enter the EU through a border inspection post. In August 2018 the government published 25 technical notices setting out what UK citizens and businesses would need to do in a no deal scenario, but none of these related specifically to chemicals, export health certificates or fisheries. The government announced that more technical notices would follow in September (paragraphs 1.24 and 1.25).

Conclusion

18 Defra has done well in very difficult circumstances. Despite facing many challenges that are outside its control, it has rapidly expanded its workforce, quickly filling some of its skills gaps and moving ahead with building the IT systems it needs in case no deal is reached with the EU.

19 What really matters now though is that Defra accelerates its medium-term planning for the Withdrawal Agreement while finalising its contingency plans. It also needs to make sure that the centre of government is fully aware of the key elements that Defra is unlikely to deliver for a no-deal scenario and of impacts on key industry sectors, such as the chemical industry, which could be seriously damaged if a negotiated settlement is not reached.

1 Comptroller and Auditor General, Implementing the UK’s exit from the European Union: The Department for Environment, Food & Rural Affairs, Session 2017–2019, HC 647, National Audit Office, December 2017.

2 ‘Work stream’ is the term used across government for each of the 319 distinct projects that need to be completed to prepare for EU Exit.

3 Defra uses planning standards that are more stringent than those used by DExEU to assess departments’ plans.

Part One

Management of the EU Exit portfolio

1.1 This Part covers:

the scale of Defra’s task;

structure and governance of the EU Exit programme;

resources for EU Exit; and

stakeholder engagement.

The scale of Defra’s task

1.2 In March 2019, the UK is set to leave the EU. The government is currently negotiating the terms of the Withdrawal Agreement and the likely form of the future relationship with the EU. In March 2018, the government and the European Commission published the latest draft text of the Withdrawal Agreement, under which the UK would continue to participate in European programmes and be bound by EU law until the end of 2020. The terms of the Withdrawal Agreement are, however, dependent on both sides reaching an overall agreement and this is not yet certain. The government has instructed departments to make the necessary preparations for a negotiated deal but also to have contingency arrangements in place should they be needed.

1.3 Defra is one of the government departments most affected by EU Exit. It estimates that approximately 80% of its areas of responsibility are currently framed by EU legislation and that 25% of EU laws apply to its sectors. “Delivering a smooth transition to new regulatory and delivery frameworks after we leave the EU” is one of the four primary objectives set out in its single departmental plan.4

1.4 Defra’s EU Exit portfolio is varied as well as extensive. It has policy responsibility for major areas of the UK economy such as food and chemicals, both of which are deeply affected by EU Exit. Defra will have to establish new arrangements for the import and export of animals and animal products and a new regulatory function for the chemical industry. It will also need to develop major new policies for agriculture, fisheries and the environment.

Structure and governance

Defra’s revised EU Exit portfolio

1.5 In our last report, we set out how, in order to prepare for EU Exit and allow the task ahead to be better understood, departments had organised their overall workloads into separate ‘work streams’.5 This process led to the establishment of 313 EU Exit work streams across government, of which Defra was responsible for 43. In spring 2018, Defra, with the help of consultants, reviewed the scope and prioritisation of its EU Exit portfolio to ensure that it captures the full breadth of the department’s EU Exit work. The revised portfolio increased the number of delivery work streams to 64 but this has now fallen to 55 as two of the 64 have closed and a further seven have been combined with others. There are also 12 cross-cutting activities and two coordinating activities covering other government departments and arm’s-length bodies. There are now 319 work streams across government.

1.6 The original 43 projects focused on preparations for exit in March 2019 without a deal, while the revised portfolio includes all Defra’s negotiation, legislation, devolution and longer-term activities. This work has not identified new work specifically, but brings all existing EU Exit activities under a common governance, accountability and reporting structure. This report is based on the 43 original work streams in place until May 2018 because Defra’s portfolio was in transition during our analysis.

1.7 We previously reported that 20 of Defra’s 43 work streams included an IT element. This too has changed following further clarification of the minimum requirements for a no-deal exit in March 2019. Defra also sought to limit the amount of IT work required in order to reduce demands on its Data, Digital and Technical Services division that delivers its IT developments. In March 2018, Defra estimated that 14 of its 43 work streams would require an IT component. In July 2018, this reduced further to 11 as a result of the amalgamation of four of its work streams.

1.8 Defra has also changed its governance structure with the aim of strengthening programme management. In March 2018, Defra introduced a new EU Exit Delivery Group, headed by a new Director General, bringing together the existing EU Exit Overview team, the Programme Management Office (PMO) and the legislation and devolution teams.

Portfolio management

1.9 In order to comply with the Department for Exiting the European Union (DExEU) guidance, Defra, in common with other departments, has approached planning from the bottom up by focusing on producing detailed plans for each of its individual work streams. It has developed a portfolio plan to provide an integrated view of the most critical challenges across the work streams and to strengthen its ability to:

identify the most severe impacts and decide where it should focus its delivery and negotiation efforts to minimise the impact of EU Exit on business, stakeholders and the general public in the event of a no-deal scenario;

forecast future resource needs and identify peaks and troughs across the portfolio to be able to plan resources more effectively; and

reduce potential for duplication of effort between work streams.

1.10 Defra appointed a new Director General in mid-April 2018 to oversee the portfolio and strengthen its portfolio management. It has also developed a template for more streamlined portfolio reporting, which was piloted in May 2018 on nine of the delivery work streams and three of the 12 cross-cutting work streams. Defra rolled out the new template to all work streams in June 2018. It includes narrative on the overall status of the portfolio, reasons for work streams not being on track, the status of cross-cutting work, key decisions and upcoming milestones.

1.11 In May 2018, the Portfolio Board approved several strands of work to address known weaknesses in its portfolio management. In addition to the new streamlined reporting process, Defra is:

issuing more robust planning guidance and providing professional project management support to project teams to strengthen planning skills, starting with nine of the 12 high-priority projects;

improving the alignment between project teams and cross-cutting and enabling teams, by requiring the latter to confirm that they can deliver any services required by project teams to the planned timetable and also improving the alignment of plans and activities between work streams and cross-cutting teams;

revising the structure of the PMO, introducing more senior staff to enable stronger challenge of project teams, and downsizing the core team to release resources for a cadre of business partners and delivery advisers;

working with human resources to fill key skills gaps in projects; and

producing a communications strategy to deliver a strategic narrative on EU Exit, both internally and externally, with delivery partners and other government departments.

1.12 Following publication of the draft Withdrawal Agreement in March 2018, which included provision for an implementation period, Defra has developed an approach to portfolio level planning and prioritisation for a no-deal scenario. The aim of its new approach is to refocus its efforts on being prepared by December 2020, when the implementation period comes to an end, while planning what contingencies are needed for a potential no-deal exit in March 2019.

1.13 During April 2018, Defra designed a framework and held a series of workshops with each of the project teams to assess the impact for each work stream of not delivering the minimum capability by March 2019, and to consider how the risks arising from not being fully prepared could be managed.

1.14 Some work streams, such as environmental governance, were excluded because Defra was not planning to have new arrangements in place by March 2019. In other cases it was already too late, for example to establish new border inspection posts for food imports. For the rest, Defra mapped the financial and reputational costs as well as costs in terms of national security against the benefits it would gain, for example from freeing up scarce capability or avoiding public concern. It then used this information to decide for each work stream whether to pause its no-deal preparations, reduce them or carry on in full.

Target operating models

1.15 Defra is introducing a number of major new services and functions, including a new international trade function for food imports and exports and a new chemical regulatory service. It will need to develop stronger relations with its delivery bodies as it delegates delivery of some post-EU Exit functions.

1.16 To date, Defra has focused on its immediate priorities to ensure that it has what it needs in place in the event of exit in March 2019 without a deal. Although not knowing the terms of the UK’s exit makes this difficult, Defra now needs to consider how EU Exit affects its organisational strategy and future vision. It has not yet adapted its target operating model for the group as a whole post-EU Exit. It has not mapped out the shape and structure of the Defra group in the longer term as it starts to deliver new functions and services nor developed the target operating models for these. Some basic decisions about the longer-term functions have not been taken, for example which organisation will host the new IT system being developed for the UK’s chemical regulatory regime.

Resources for EU Exit

1.17 Defra has received additional funding for its EU Exit programme. HM Treasury approved funding of £94 million in 2017-18, including funds for Defra’s arm’s-length bodies. This comprised new funding of £67 million, and £27 million that Defra was expected to find from its existing resources. In March 2018, Defra submitted a bid for funding for 2018-19 to HM Treasury and received approval for spending of £320 million, approximately two-thirds of what was initially requested. Of this, £10 million will come from Defra’s existing resources. Defra told us it reduced its original bid during discussion with HM Treasury, and agreed the final total was sufficient for its needs.

1.18 This funding has now been allocated to each of the work streams. In addition, funding has also been allocated to the cross-cutting teams, including £42 million to the central Data, Digital and Technology Services to deliver IT development and £35 million to estates. Defra has centrally retained £5 million (2%) as contingency.

1.19 Defra met its EU Exit recruitment target of 1,300 new staff in 2017-18, having recruited 1,307 staff by March 2018 with 1,182 of those in post by that time. This represents an increase in its workforce of 5% across the group compared with 2016-17, and reversed the downward trend in staff numbers since 2010-11. Most of those recruited were in the core department, and the average number of staff over 2017-18, excluding corporate services staff who transferred from Defra’s arm’s-length bodies into the core department, is 43% higher than 2016-17 (Figure 2).

1.20 Over half the additional staff recruited for EU Exit in 2017-18 were in the policy profession (Figure 3). In order to assimilate the new staff, many of whom are from outside the civil service, Defra has strengthened its induction programme and expanded its human resources and estates teams.

1.21 Defra has a continuing challenge for 2018-19, because it is aiming to recruit at least 1,300 further staff and will need to maintain its efforts to assimilate its new staff and to ensure that its corporate functions are sufficient to recruit, train and accommodate them. Its priorities are shifting as it moves into the delivery phase. It is now targeting:

analytical specialists with an increase in posts across the Defra group, not just in the core department;

policy staff with increased focus on trade and negotiations; and

digital, project delivery, project management and corporate services staff across the group.

1.22 Of the 1,307 staff recruited in 2017-18, over half (51%) are fixed-term appointments, mostly for two years, and 40% are on loan or secondment. Defra has relied heavily on consultants to support its EU Exit programme and to fill key skills gaps. For example, it has contracts to the value of up to £6.7 million with PwC to include support for creating project delivery plans and, over the period 2017 to 2019, to support Defra’s Data, Digital and Technical Services on EU Exit IT. It also has contracts with Boston Consulting Group valued at £9.5 million to act as a strategic partner to Defra, reviewing the scope, prioritisation and accountabilities of the whole EU Exit programme.

Stakeholder engagement

1.23 EU Exit has significant implications for a wide range of Defra’s stakeholders, particularly businesses in the food and chemical sectors, and in the fishing industry:

Some exporters of animals and animal products will need to apply for export health certificates for the first time and may also need to change their trading routes so that their products can enter the EU through a border inspection post.

UK chemical manufacturers may be unable to sell their products to other EU member states because the registrations of their products with the EU may no longer be recognised by the EU after exit.

Defra needs to provide advice and guidance to the fishing industry to prepare it for regulatory changes and enable fishers to understand and familiarise themselves with new requirements to achieve compliance.

1.24 The restrictions placed on departments on what they are permitted to discuss with stakeholders have caused difficulties for Defra on several of its work streams:

Defra has prepared a business readiness plan for export health certificates. This identifies what actions it needs to take to ensure that existing and potential new exporters are aware of and ready for the coming changes. However, Defra’s progress was hampered because it needed to agree its approach to publishing messages to stakeholders with DExEU and other parts of government and some project teams in Defra were unclear what the process was for securing this agreement.

Defra has produced a stakeholder matrix for the import control system but has been slow to start stakeholder engagement and communications on this project for both internal and external reasons. Internally, a lack of resources delayed the production of a stakeholder plan, because the stakeholder and change manager position was not filled until January 2018. Externally, the project team’s ability to engage with stakeholders has been similarly hampered by government restrictions communicated through DExEU. When Defra has engaged with customer groups, it has required participants to sign non-disclosure agreements.

Communications with the fishing industry have been hampered by central government restrictions and there is a risk that the industry is unclear about the rules and obligations in place, with the resulting confusion potentially leading to exploitation of these rules. Defra’s delivery body, the Marine Management Organisation, has produced a stakeholder map and a communications strategy for the fishing industry but needs a longer-term plan to help the fishing industry keep abreast of developments.

1.25 Until July 2018, relevant pages of Defra’s website, for example on chemical regulation and export health certificates, contained no reference to EU Exit. Defra’s webpage on how to comply with EU regulations on using, making, selling or importing chemicals contains no reference at all to EU Exit or any potential changes following EU Exit. The most detailed guidance for UK chemical companies was provided by the European Chemicals Agency. In Defra’s report to DExEU in April 2018, Defra reported that the existing permitted narrative for businesses is “out of date and continuing to use it risks damaging our ongoing relationship, trust and reputation”. In July 2018, Defra was permitted to publish a statement on the implications of an implementation period on the chemicals industry. The Prime Minister announced in July 2018 that the government would publish around 70 “technical notifications”, setting out what UK citizens and businesses would need to do in a no-deal scenario. The government published the first 25 notices in late August but none of these related specifically to chemicals, export health certificates or fisheries.

4 Department for Environment, Food & Rural Affairs Single Departmental Plan, May 2018 (www.gov.uk/government/publications/department-for-environment-food-and-rural-affairs-single-departmental-plan/department-for-environment-food-and-rural-affairs-single-departmental-plan-may-2018).

5 Comptroller and Auditor General, Implementing the UK’s exit from the European Union: The Department for Environment, Food & Rural Affairs, Session 2017–2019, HC 647, National Audit Office, December 2017.

Part Two

Progress on the individual work streams

2.1 In Part One, we reported on how the Department for Environment, Food & Rural Affairs (Defra) is managing its EU Exit portfolio as a whole. In this Part, we report on progress on the individual work streams with a focus on four work streams where we carried out a detailed review (Figure 7 on page 26) and on Defra’s legislation programme, one of its five central planning work streams.

2.2 We selected these work streams to cover the range of changes Defra must make, including establishing new regulatory functions and services, changes to business practices and processes, developing supporting IT systems and working with third parties. All four projects were originally categorised as high priority although marine control and enforcement was downgraded to medium priority in April 2018.

Maturity of project plans across the portfolio

2.3 As a result of Defra’s review of its portfolio, the number of work streams for which it is responsible increased from 43 to 64 and has now fallen to 55. We report here on the 43 original work streams in place until May 2018 because Defra’s portfolio was in transition during our analysis. By early April 2018, only six of the 43 work streams had plans that Defra considered to be fully compliant with its planning standards.6 Seven of the plans were still in the early stages of development (Figure 4).

2.4 The Programme Management Office (PMO) reported to the Programme Board in March 2018 that as many project milestones across Defra’s portfolio had been missed as had been met. In a 10-week period between early February and early April 2018, 39% of milestones across the portfolio had been pushed back with an average delay of seven weeks. Defra attributes its missed milestones to its original plans being optimistic and based on planning assumptions that later transpired to be incorrect. It was initially slow in developing its detailed plans and took time to increase its programme and project management capability. Until May 2018, the PMO reported on numbers of missed milestones but not on the consequences of these missed and delayed milestones, making it difficult in the NAO’s view to reliably assess progress across the portfolio. From May 2018, the PMO started to collect the detailed information on missed milestones, their causes and the mitigating actions required to get back on track. The new reporting process also identifies key risks and issues at both portfolio and project levels.

2.5 In April 2018, Defra began a further re-planning exercise as a result of its portfolio review and also to take account of a potential implementation period. It had new plans in place for 12 work streams by the end of June 2018, but does not expect to complete its work on the remainder until September 2018.

Portfolio risk

2.6 Defra reports to the Department for Exiting the European Union (DExEU) monthly on its overall progress, using a standard template used by all departments that includes coverage of overall progress, risks, barriers and upcoming milestones. It also reports for each work stream, for both no-deal and negotiated settlement scenarios, on whether it is on track to deliver and on its delivery confidence.

2.7 Every month, the PMO provides a report to the EU Exit Portfolio Board showing a number of indicators for each work stream on portfolio risk. In April 2018, the PMO reported that 30 of its work streams were rated red or amber, a decrease from 32 in March 2018 (Figure 5). At that time, the PMO reported that “while many of the individual work streams may be deliverable, the overall complexity and aggregate risk in the portfolio make it unstable”.

2.8 The PMO also reported on risk levels for 16 individual aspects for each work stream, covering engagement and change, team management, scope and plan, finance, outputs and benefits. Figure 6 shows a substantial increase in reported risk levels across the portfolio from March to April 2018. Defra attributes this to an increased level of project management expertise and an improved understanding of work stream requirements, indicating that it did not have a full understanding of the portfolio risks until April 2018.

Progress on individual work streams

2.9 In addition to looking at progress across the portfolio, we examined four of the work streams in more detail. In this section, we report on each of these four work streams. Figure 7 summarises the scope of each of the four work streams and Figure 8 provides an overview of progress. We also report on Defra’s legislative programme.

Regulation of chemicals

2.10 In 2017, UK exports of chemicals and chemical products amounted to £28.3 billion, £17.0 billion (60%) of which was to other EU member states. These exports are predominantly by small- and medium-sized enterprises that make up 97% of the sector. If a negotiated settlement is not reached for trade in chemicals, the UK will end its participation in the European Chemicals Agency, and will need to establish its own regulatory regime for chemicals and facilitate continued trade for the sector. UK chemical manufacturers currently use the EU web-based system, REACH (registration, evaluation, authorisation and restriction of chemicals), which took 14 years to develop and contains over 200 pages. Defra will need to put in place the systems to support registration of new chemicals and products to replace the EU’s REACH system. Its focus to date has been on ensuring that it has a functioning registration IT system in time for a possible no-deal scenario in March 2019 and it has not yet started to consider in detail what the future regulatory function will look like nor how it will be managed.

2.11 The UK’s position, as set out in the July 2018 white paper on the future relationship between the UK and the EU, is to seek continued participation in the European Chemicals Agency and to ensure that UK businesses can continue to register chemical substances directly rather than working through an EU-based representative. Without this negotiated settlement, UK chemical manufacturers would no longer be able to export their products to EU member states because registrations of products on the EU’s REACH system would cease to be recognised by the EU. To recover market access, they would need to re-register their products on the EU’s system via an affiliate or representative based in an EU member state. This is a lengthy process that cannot be started until the UK has left the EU.

2.12 Defra’s two most challenging EU Exit IT projects are developing the UK’s equivalent of REACH and the import control system for animals and animal products, and it has taken a similar approach to both. It is aiming to ensure that a minimum operating capability is in place at the point of exit, while trying to ensure that this is built in a way that can be used as a building block for the development of increased functionality over the longer term.

2.13 In its development of the UK’s IT system for chemicals, we found that time pressures had led to this focus on registrations and the storage and processing of the registration data that may be needed in a no-deal scenario in March 2019 to ensure that a workable system is in place for the point of exit. This approach was agreed with HM Treasury and the Cabinet Office. The more fundamental work to allow additional future data processing can only be based on assumptions at this stage because Defra has not yet decided what the future regulatory regime will look like. But there is a risk that the initial design may not lend itself to further development without significant rework or rebuild at extra cost to enable the longer-term enhancement of functionality. This is contrary to what Defra set out in its outline business case and to its expectations that 60% of its contractor’s work would focus on the back-end foundation work. We did not see this risk being explicitly acknowledged in the governance documents and business case submission.

2.14 Defra’s objective is to replicate the EU’s REACH IT system as closely as possible in order to expedite the build and provide continuity for chemical companies. The web screen work that the supplier is undertaking aims to comply with the Government Digital Services’ standards to maintain the ‘look and feel’ of GOV.UK, wherever appropriate. This means that the UK’s system will differ from the EU’s REACH system. Therefore, UK chemical companies operating in both the EU and the UK will have to navigate two slightly different systems. We saw no evidence that Defra had considered the impact this dual approach would have for chemical companies but Defra told us it had started to undertake more detailed user testing with industry in August 2018.

2.15 The performance reporting we have seen for this work stream is based on descriptions of the process to build screens rather than achievement against milestones. The reports are therefore on activity rather than outcomes, which hampers the Portfolio Board’s ability to monitor overall progress. Defra is strengthening its governance for this work stream by widening the scope of the assurance and Portfolio Board reporting. This will include the work to define the new operating model for the regulatory service to enable the design of the future system.

Imports of animals and animal products

2.16 If there is no deal, Defra will need to establish the UK’s own system for imports of animals and animal products, including food. As with the new chemical regulatory function, Defra is focusing on building an IT system that will provide the minimum operating capability, assuming the UK will no longer have access to the import functions of the EU’s TRACES system. Its approach therefore focuses on data processing and the development of screens. As with REACH, there is a risk that the approach may restrict the development of longer-term functionality, such as adding further modules for plants and other commodities.

2.17 Defra’s plans for the import control system include contingency arrangements in case the IT solution is not ready on time. These include manual workarounds to replace the interface between the systems of different agencies involved. Currently, the EU’s system allows border inspection posts to use data directly from its TRACES system. Without this facility, the border inspection posts will need to enter data manually into their databases. It is likely that manual data entry would lead to higher error rates, which in turn could lead to delays at the border while manual checks are carried out and an increased biosecurity risk when errors are not detected.

Exports of animals and animal products

2.18 Defra currently has a spreadsheet-based system for export health certificates (EHCs) but does not expect to be able to handle the significant increase in volume that may occur. Currently, only one operator can save their input on to the system at any one time. Defra has identified two options for an improved IT system for a no-deal exit in March 2019. It initially expected to make a final decision in June 2018 as to which one to pursue, but a decision was not made until late July. This was to implement an eight-week development to mitigate risks in the EHC service. In the longer term, Defra intends to transform the certification process from a manual system to an e-certification system to bring it in line with other countries. The business justification document for this was due for submission to HM Treasury in June 2018 but this was pushed back to August 2018 and has now been delayed further to September 2018.

2.19 The UK’s current trade with the EU is largely not recorded. Where it is, for example for some high-risk consignments such as live animals, it is done on a module of the EU’s TRACES system (trade control and export system). When the UK leaves the EU, and if it is required to fully meet the rules applying to non-EU countries, it will have to notify the EU through a different module of TRACES designed for non-EU countries. Defra has asked the EU to grant technical access to this module so that Defra can design its own system appropriately. In September 2018, the EU had not yet agreed to this.

2.20 There are currently over 1,400 versions of EHCs in use, because there are different versions for each country and each commodity. Each of these refers to EU law and so Defra needs to negotiate with 154 non-EU countries to agree acceptance of UK versions of EHCs. It is focusing on reaching agreement with 15 of these countries that it estimates account for approximately 90% of total exports to non-EU countries of animal products, food and live animals, but it is not expecting to be able to complete negotiations by March 2019 with all the remaining 139 countries. Defra has classified these remaining countries as medium or low priority, either by virtue of low trade volumes, or because ad hoc EHCs have been created for one-off exports of specific commodities. Defra has accepted the risk that firms currently exporting to those countries where agreement is not reached will not be able to do so for a period after EU Exit.

2.21 Without a significant increase in the UK’s veterinary capacity, Defra will be unable to process the expected increased volume of EHCs following EU Exit. To achieve the required capacity, Defra needed to provide the market with sufficient notice and certainty about the scale of the increased capacity required. It had programmed this work to start in April 2018 but government restrictions have prevented Defra from starting its engagement with the veterinarian market. If there are not enough vets, consignments of food could be delayed at the border or prevented from leaving the UK. If there is still a significant likelihood of no-deal in October 2018, Defra is planning to launch an emergency recruitment campaign to bring capacity at least part-way towards the minimum level required, and Defra told us it is confident that it will be able to fill any remaining gaps, for example through the use of non-veterinarians to check records and processes that do not require veterinary judgement.

Marine control and enforcement

2.22 Currently, Defra adopts a risk-based intelligence-led approach to control and enforcement in English fishing waters using an EU data system whereby EU countries share intelligence and provide mutual support including marine surveillance. Defra wishes to strengthen its control and enforcement activities following EU Exit. The ability to demonstrate a clear and robust enforcement intent in the period leading up to and after EU Exit will be an important factor in driving compliance and reassuring those who are compliant that it is beneficial.

2.23 Defra is proposing to supplement the current approach with additional at-sea and aerial capability. This will both act as a deterrent and allow the UK to respond to control issues such as conflict or organised non-compliance by domestic and EU fishing fleets. Defra has not yet fully developed its plans to do this. It is still in early discussions with HM Treasury over funding requirements, and HM Treasury has stipulated that it will not release the necessary funding until Defra has submitted a full business case.

2.24 Ministers provided a steer on their preferred option for the way forward in December 2017. There were initial delays, because staff in Defra’s delivery body, the Marine Management Organisation (MMO), did not have the necessary expertise to complete some elements of the business case, and they had to wait for the required support from Defra to become available. The latest target date for approval of the full business case was set as the end of July 2018 but this was not met. MMO submitted an outline business case in August 2018.

2.25 Even if MMO had met its target of full business case approval by July 2018, it would have had only 8 months to put in place the necessary control and enforcement arrangements. The two activities with the longest lead times are the recruitment and training of additional marine enforcement officers (estimated to take 12 months for a fully warranted officer, including 12 weeks’ training and several months of on-the-job training), and the procurement of marine and aerial surveillance (estimated to take between 3 and 12 months, depending on the chosen procurement route).

2.26 In a no-deal scenario with no implementation period, Defra intended to have its planned increase in control and enforcement capacity in place by March 2019. Although HM Treasury has provided some interim funding to allow progress to be made on elements with the longer lead-in times, this is now unlikely. Defra’s contingency plan is to continue with the current level of surveillance and manage the associated risk of lower capacity. The risk will be heightened if the UK loses access to EU intelligence and the mutual support that its current approach relies on. We are therefore surprised that, in May 2018, Defra was reporting this work stream as being on track for a no-deal scenario and amber for its overall risk rating. Defra told us it was confident that it would be able to manage the risk of lower capacity and that, with an implementation period to December 2020, it will be able to complete its planned procurement and recruitment activities, scaling up its patrolling capacity over the period.

The legislative programme

2.27 Defra now has a challenging legislative programme to prepare for EU Exit and must compete with other departments for very limited parliamentary time. There are 49 House of Commons sitting days from September to December 2018, by which time Defra was aiming to ensure that virtually all its statutory instruments (SIs) were laid, and 97 sitting days until March 2019. In July 2018, Defra told us that some SIs would be pushed back into the first three months of 2019. Delays in the enactment of the EU Withdrawal Act added to the squeeze on parliamentary time.

2.28 Defra has not been responsible for any new major primary legislation since the Water Act of 2014 but it is now preparing three new bills:

The Agriculture Bill proposes new financial assistance powers to pay public money for public goods. Existing farm subsidies (in the form of direct payments to farmers) will be phased out over a transition period. It also legislates to strengthen data collection powers and other measures to support the position of farmers in the supply chain and to support animal and plant health. Defra published a consultation paper in February 2018 setting out its proposals for future farming in England following EU Exit. It received over 40,000 responses.

The Fishing (Access to Territorial Waters) Bill will enable the UK to control access to its waters and set UK fishing quotas once it has left the EU. Defra published a consultation document on fisheries in early July 2018.

The Environmental Principles and Governance Bill will create a new independent environmental watchdog to hold government to account on environmental ambitions and obligations once the UK has left the EU.

2.29 In addition to its primary legislation, Defra also needs 93 SIs to complete the conversion of EU law into UK law at the point of exit. This is in addition to an estimated 58 SIs needed for Defra’s other business, bringing the total required for 2018 to 151. This is more than double the average of 75 SIs in the eight years to 2017 (Figure 9). Defra’s legislation team is expanding from 65 to 89 full-time equivalent staff during 2018-19 and, by June 2018, had completed the first draft of 33 (35%) of the 93 SIs it needs for EU Exit. However, 37% were either not started or less than halfway to a completed first draft. Because of the shortage of parliamentary time available, Defra’s legislation team reported to the Portfolio Board in June 2018 that, in the event of exit without a deal in March 2019, “Defra is at high risk of being unable to deliver a full and functioning statute book by end March 2019”, and in July 2018 its secondary legislation programme was rated as red. Defra is seeking to minimise the number of non-EU Exit SIs needed by, for example, considering which ones can be delayed beyond March 2019. It has also revised its plans to allow some of its EU Exit SIs to slip into the first quarter of 2019.

6 Defra uses planning standards that are more stringent than those used by DExEU to assess departments’ plans.

Appendix One

Our audit approach

1 This report provides our independent opinion on whether the Department for Environment, Food & Rural Affairs (Defra)’s progress in preparing for exiting the EU is sufficient.

2 We developed our own evaluative framework to assess progress, which considers:

the robustness of the programme management arrangements for EU Exit;

the degree to which Defra is adequately resourced for the task; and

whether Defra has made sufficient progress with individual work streams to be ready in time for EU Exit.

3 Our audit approach is summarised in Figure 10. Our evidence base is described in Appendix Two.

Appendix Two

Our evidence base

1 Our independent conclusions on whether the Department for Environment, Food & Rural Affairs (Defra) has made sufficient progress in preparing for EU Exit were reached following our analysis of the data we collected. Our fieldwork took place in April and May 2018.

2 We applied an evaluative framework to consider the progress Defra has made in implementing the UK’s exit from the EU. Our audit approach is outlined in Appendix One.

3 We assessed the programme management arrangements for Defra’s EU Exit portfolio as follows:

We conducted interviews with key personnel in the Programme Management Office.

4 We reviewed the resources available to Defra for implementing its EU Exit portfolio as follows:

We conducted interviews with officials in key functions including finance, human resources, procurement and Defra’s Digital and Data Technology Services.

We reviewed the plans for finance and resources for exit work from 2017 onwards.

We reviewed four specific work streams to identify any gaps and the impact these may have on progress.

5 We examined whether progress in implementation is sufficient to be ready in time for EU Exit as follows:

We conducted interviews with key personnel across Defra and its delivery bodies, including interviews with the senior responsible officers for EU Exit, as well as people in key functions including legislation, devolution, and project management for EU Exit work.

We examined progress reporting to the Department for Exiting the European Union (DExEU) between January and April 2018. We also reviewed progress reporting within Defra over the same period.

We carried out four case study reviews of specific work streams. These were chosen to cover a number of directorates and provide insight into different challenges in delivery for Defra. We reviewed business cases and working-level plans in all cases. We undertook interviews with key stakeholders within Defra, and within relevant arm’s-length bodies where appropriate.

We undertook stakeholder analysis for our case studies using publicly available information to identify who the stakeholders are and what their concerns are about EU Exit.

Appendix Three

The Department for Environment, Food & Rural Affairs’ (Defra’s) EU Exit portfolio

Design and Production by NAO External Relations
DP Ref: 006328-001