Report

by the Comptroller
and Auditor General

Cabinet Office

Investigation into Verify

HC 1926 Session 2017–2019 5 March 2019

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund, nationally and locally, have used their resources efficiently, effectively, and with economy. The C&AG does this through a range of outputs including value-for-money reports on matters of public interest; investigations to establish the underlying facts in circumstances where concerns have been raised by others or observed through our wider work; landscape reviews to aid transparency; and good-practice guides. Our work ensures that those responsible for the use of public money are held to account and helps government to improve public services, leading to audited savings of £741 million in 2017.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 4 March 2019

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

1 March 2019

This report examines the performance and costs of GOV.UK Verify to date, the programme’s decision-making and the implications of the government’s decision to stop funding Verify in March 2020.

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

© National Audit Office 2019

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

006469 02/19 NAO

The National Audit Office study team consisted of:
Jessica Bingham, Eleanor Fairbairn, Yvonne Gallagher, Grant Lawrence, Pauline Ngan and Alberto Vanzo, under the direction of Siân Jones.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

What this investigation is about

1 The Government Digital Service (GDS) developed GOV.UK Verify (Verify) as the government’s flagship identity verification platform,1 following ministerial agreement on a cross-government approach to identity assurance.2 Verify was intended to be the default way for people to prove their identity when using digital services that need to know who the user is (such as claiming tax back and receiving benefit payments). GDS expected the programme to cost £212 million and generate benefits of £873 million over four years from 2016-17 to 2019-20.

2 People sign up for Verify to prove their identities, so they can securely access online government services such as Universal Credit or to claim a tax refund. Once online, people are asked to pick from a list of ‘identity providers’, who verify their identities using a range of evidence and methods (including documentation checks). Once their identities are verified, people are then provided with a log-in so they can access the online services they need. Verify uses commercial organisations to verify people’s identities.

3 In October 2014, GDS began public trials of Verify with a small number of government services. It has since added more government services, and 3.6 million people have been verified by February 2019. The performance of Verify has consistently been below the standards set out in each of its business cases. GDS intended that Verify would be largely self-funding by the end of March 2018, but low take-up means that government continues to fund it centrally.

4 The Cabinet Office announced in October 2018 that government would stop funding Verify in March 2020. It has capped the amount it will spend on Verify during this time to £21.5 million. GDS has confirmed 18-month contracts with five commercial identity providers who will continue to verify people’s identities. After March 2020, GDS’s intention is for the private sector to take over responsibility for Verify. It believes providers will take responsibility for “invest[ment] to ensure the delivery of Verify” and “broadening the usage and application of digital identity in the UK”.3

5 This report follows on from our previous work on Verify in the Digital transformation in government report.4 This found that take-up of Verify had been undermined by its performance and that GDS had lost focus on the longer-term strategic case for the programme. This report looks at:

how Verify was set up, what it intended to achieve and performance to date;

total costs of Verify and estimated benefits;

key decisions made during the programme, including the recent government decision to stop funding Verify; and

how Verify will operate in the future and the implications for government services currently using Verify.

1 Cabinet Office, ‘Five new providers join flagship identity verification service’, press release, 25 March 2015. Available at: www.gov.uk/government/news/five-new-providers-join-flagship-identity-verification-service

2 See paragraph 1.1.

3 House of Commons, ‘GOV.UK Verify programme: written statement’, HLWS946, 9 October 2018. Available at: www.parliament.uk/business/publications/written-questions-answers-statements/written-statement/Commons/2018-10-09/HCWS978/.

4 Comptroller and Auditor General, Digital transformation in government, Session 2016-17, HC 1059, National Audit Office, March 2017.

Summary

Key findings

1 GOV.UK Verify (Verify) was intended to be a flagship digital programme to provide identity verification services for the whole of government. The Government Digital Service (GDS) considers it to be a strategically ambitious programme that includes not only the development of the Verify platform, but also an identity assurance framework and a commercial model that supports a growing identity market. In its 2016 business case, GDS identified the following key targets and expectations for the platform: 25 million people would use Verify by 2020, and 46 government services would be accessible through Verify by March 2018.

Verify’s performance and benefits

2 GDS developed an identity assurance framework on which the Verify platform is based. The UK’s National Technical Authority on Identity Assurance issued guidelines that GDS used to develop its identity assurance framework in 2012. Based on this framework, GDS developed the Verify platform for public trials by October 2014. In 2017, the Infrastructure and Projects Authority (IPA) noted that the Verify platform “has been an innovative technical success and is performing to specification, [but] it is not producing the promised benefits, which rely on the large numbers of people signing up” (paragraph 1.2).5

3 GDS is not on track to meet the target of 25 million users signed up to Verify by 2020. By February 2019, 3.6 million people had signed up for Verify. If current trends continue, approximately 5.4 million users will have signed up by 2020. Lower than expected take-up had started to become evident by 2016 and has persisted despite efforts to boost user numbers (paragraphs 1.7, 1.9 and 1.10 and Figure 2).

4 Nineteen government services currently use Verify, less than half the number expected by March 2018. In 2016, GDS expected 46 government services to have connected to Verify by March 2018. At least 11 of the 19 government services using Verify can be accessed through other online systems. Some government service users, for example those using Universal Credit, have experienced problems using Verify. As a result, departments have needed to undertake more manual processing than they anticipated, increasing their costs (paragraphs 1.7 and 1.11 – 1.15 and Figure 3).

5 GDS reported a verification success rate of 48% at the beginning of February 2019, against a 2015 projection of 90%. The verification success rate measures the proportion of people who succeed in signing up for Verify in a single attempt out of all those who try. These people have had their identities successfully confirmed by a commercial identity provider. Some failures to sign up are not counted as part of this measure, such as the number of people dropping out before they finish their applications. The verification success rate also does not indicate whether people can actually access and use the government services they want after being successfully verified (paragraphs 1.7, 1.16 – 1.17).

6 GDS currently estimates that Verify’s expected benefits would be £217 million for the four years between 2016-17 and 2019-20. In its 2016 business case, GDS estimated that Verify’s benefits would total £873 million for the period 2016-17 to 2019-20. It has now revised its benefits estimate for this period to £217 million, 75% lower than its original estimate. GDS classifies these benefits as non-cash releasing.6 A significant proportion of Verify’s expected financial benefits come from avoided building costs (spending that departments would otherwise have needed to incur to build or procure an alternative identity verification system). We have not been able to replicate or validate GDS’s estimated benefits on the evidence made available to us (paragraphs 1.18 – 1.21 and Figure 4).

Costs and funding

7 Verify and its predecessor programme have cost at least £154 million so far. From 2011-12 to September 2018, GDS’s total programme spending on Verify and the predecessor Identity Assurance Programme was £154 million. Of this, payments to providers came to £58 million – more than one-third of total reported costs. However, £154 million is likely to be an underestimate of all costs across government, as GDS’s reported spending does not include, for example, the costs to departments of reconfiguring their systems to use Verify (paragraphs 2.2 – 2.3 and Figure 5).

8 GDS has not achieved the goal set out in its 2016 business case of making Verify largely self-funding by March 2018. Under the original commercial model for Verify, GDS expected that prices paid per sign-up would fall over time as user numbers increased. In practice, user volumes did not increase as expected and average prices paid to providers remained above £20 for new verifications. High prices meant that GDS has continued to subsidise departments for using Verify. Moreover, most departments have not paid the Cabinet Office and GDS even for subsidised services. HMRC has paid £6.7 million for its Verify usage, but between 2016-17 and 2018-19 no other department paid for using Verify, despite being issued invoices by the Cabinet Office. It is unclear why some departments have not paid these invoices (paragraphs 2.3 and 2.5 – 2.8).

9 The most recent Verify contracts reduce prices paid to providers. GDS has signed new contracts with providers which apply from October 2018 to March 2020. These new contracts set a lower price for each user sign-up and provide for the price to reduce further as user volumes increase. By April 2020, GDS expects the price per sign-up to fall to a level that would make the delivery of Verify cost-neutral (paragraph 2.4).

Decisions on Verify’s future

10 GDS and the Cabinet Office have tried several times to address problems with the Verify programme. Verify has been subject to over 20 internal and external reviews. The number of reviews in part reflects efforts by GDS to re-evaluate and reset the programme. In 2016, GDS revised its business case and planning assumptions following an internal review to refocus the programme. It commissioned external support in 2017 to inform the strategic direction of the programme and implemented several measures to try to increase user volumes (such as introducing verifications at a lower level of assurance). Despite these efforts, a review by the Infrastructure and Projects Authority (IPA) in July 2018 recommended that Verify be closed as quickly as practicable, bearing in mind Universal Credit’s critical dependency on Verify (paragraphs 3.2 – 3.4 and Figure 6).7

11 The Cabinet Office and HM Treasury decided in 2018 to stop government funding for Verify. In May 2018, the Cabinet Office and HM Treasury approved GDS’s proposal to ‘reset’ Verify to improve its performance and value for money. The Chief Secretary to the Treasury adopted tests recommended by the IPA, requiring GDS to work with other departments to get their buy-in and increase the number of user verifications. These tests were not met. The Cabinet Office announced in October 2018 that government funding to Verify would cease in March 2020. GDS will withdraw from its operational role running Verify at this point (paragraphs 3.5 – 3.7).

12 GDS is currently considering what the commercial model for Verify will look like post-April 2020, and how private sector providers will take over control and management of Verify. One possibility is that departments would procure identity verification services directly from the market of private sector providers. Departments currently do not pay their full usage costs for Verify but would have to under a market-based model. After April 2020 GDS will no longer set prices, so it cannot guarantee what prices will be determined by the market in future. There is consequently a risk that the market price for identity verification services could be unaffordable for government departments using Verify (paragraphs 3.8 – 3.11).

13 Universal Credit remains Verify’s biggest government customer. The constraint on closing Verify entirely is Universal Credit, which uses it to verify the identities of claimants. However, most claimants cannot actually use Verify to apply for Universal Credit: only 38% of Universal Credit claimants can successfully verify their identity online (of the 70% of claimants that attempt to sign up through Verify). The Department for Work & Pensions is working with GDS on an improvement plan to increase the number of claimants successfully verified, and has provided £12 million to support the continued operation of Verify to March 2020 (paragraphs 1.14, 2.5 and 2.8).

Concluding remarks

14 In many ways the Verify programme is an example of how government has tried to tackle a unique and unusual problem, adapting over time in response to lessons learnt and the changing nature of the external market. Government has identified fraud as a growing threat across the modern economy, both within and beyond the public sector, and that confidence in identity is an important element of protecting services and users. In an attempt to strengthen online identity while maintaining a high degree of privacy, GDS has helped to define standards, build the Verify platform, and develop the market of private sector identity providers. After struggling to build demand within the public sector for Verify, government has now decided to hand over control of Verify to providers from 2020 with the aim of encouraging its use for non-government services, to deliver wider benefits and build scale that may benefit government in the longer term through lower prices.

15 Unfortunately, Verify is also an example of many of the failings in major programmes that we often see, including optimism bias and failure to set clear objectives. Even in the context of GDS’s redefined objectives for the programme, it is difficult to conclude that successive decisions to continue with Verify have been sufficiently justified.

5 Infrastructure and Projects Authority, GOV.UK Verify: Project Assessment Review (PAR), February 2017.

6 The IPA’s guidance on benefit management defines non-cash releasing benefits as benefits that result in departmental efficiencies but not necessarily a budget reduction, while cash releasing benefits are benefits that directly reduce a departmental budget. See Infrastructure and Projects Authority, Guide for Effective Benefits Management in Major Projects, October 2017.

7 Infrastructure and Projects Authority, Identity Management – Verify: Assurance of Action Plan (AAP), July 2018.

Part One

Verify performance and benefits

Background

1.1 GOV.UK Verify (Verify) was intended to provide a single identity assurance platform for users to prove who they are when accessing government services online. An early Verify business case recommended that “the Government Digital Service (GDS) designs, develops and brings into operation a single, cross-government IDA [identity assurance] service”.8 This was preceded by ministerial discussion and agreement on identity assurance policy leading up to Verify’s creation. In 2011, Cabinet Committee approval was given to develop a cross-government identity assurance strategy, followed by approval to build the Verify platform in 2013.9

1.2 GDS used identity assurance guidelines issued by the UK’s National Technical Authority on Information Assurance to develop an identity assurance framework in 2012, and then the Verify platform itself in 2013 and 2014. Verify was originally designed to assure an individual’s identity to level of assurance 2 (see Appendix Two for an explanation of identity standards).

1.3 People wanting to sign up to government services via Verify are asked to pick a commercial identity provider to verify their identity. Current providers include Barclays, Digidentity, Experian, Post Office and secureidentity/Morpho. Royal Mail and CitizenSafe/GBG were also providers, but recently decided not to continue as identity providers on the commercial terms applying from October 2018.

1.4 Identity providers use a range of evidence and methods to establish an individual’s identity, including documentation provided by the individual and counter-fraud checks. Providers check evidence against several sources, including their own data (such as people’s credit histories) and Verify’s Document Checking Service (DCS), which allows providers to query passport and driving licence data. The types of data used in identity verification vary depending on the provider. Once a provider has verified an individual’s identity, the user will be provided with an account and log-in. The user then logs on to the government service requested using their verified account. The government service locates the user in its own records and determines whether they are entitled to access the service being requested (Figure 1).

1.5 Verify’s providers use the GDS-run DCS to check passport and driving licence data. Approved providers query these types of data as a primary way of validating people’s identities. The DCS is seen as a valuable service for checking identity data. Most providers we spoke to indicated that they would pay to use it to support their other private sector work. However, Verify’s providers do not have access to other forms of government data that could be used to confirm people’s identities, such as tax transaction histories or activity on people’s benefit accounts.

Verify’s performance

1.6 Verify’s 2016 business case outlined its key programme objectives:

To run a service that keeps users’ data secure and safe online when accessing government services, without having to use postal, phone or face-to-face services.

To provide a service that allows departmental services to replace face-to-face, phone and postal methods of identity proofing and verification, enabling them to automate their services’ business processes.10

1.7 Verify’s performance can be assessed against the expectations set out in the programme’s business cases for service and user take-up:

Number of users who have signed up to use Verify

In both the 2015 and 2016 business cases, GDS forecast that 25 million people would use Verify by 2020.

Number of government services that use Verify

The 2016 business case expected 46 services to connect to Verify by March 2018.

Verification success rate

This measures the proportion of people who can sign up for a Verify user account having had their identities successfully confirmed by a provider. The 2015 business case states the verification success rate should be 90%.

1.8 GDS’s current performance indicators cover user take-up (both new users signing up and people reusing their accounts); the rate at which prices charged by providers fall; verification success rates; commercial development; and the creation and ownership of identity standards and fraud tools.

User sign-ups

1.9 By February 2019, 3.6 million users had signed up for Verify.11 This is significantly lower than the projections in the 2015 and 2016 business cases (Figure 2), which expected 25 million users to sign up by 2020. On average, 30,000 new users a week successfully had their identities verified in 2018. Based on current trends, user sign-ups would reach 5.4 million by April 2020.

1.10 Indications of lower than expected levels of user sign-up started to become evident as early as 2016, when the number of people signing up was 660,000 against an expected 1.4 million. GDS has made efforts to boost take-up, in particular by introducing a category of verifications in 2017 that allows people’s identities to be verified to a lower level of assurance (level of assurance 1 rather than 2 – see Appendix Two). The Infrastructure and Projects Authority noted in its July 2018 review of Verify that introducing level of assurance 1 verifications was expected to drive up volumes and lower costs, but concluded this has not proved to be the case.12

Government services using Verify

1.11 As at February 2019, 19 government services were using Verify (Figure 3). This includes services across a range of government departments and bodies. Service take-up is lower than anticipated. In 2016, GDS expected 46 government services to have connected to Verify by March 2018, but at this date only 17 services were using Verify.

1.12 Of the 19 services that currently use Verify, 11 also offer alternative digital platforms to access their services online (Figure 3). Eight of the 11 services that have alternative online access routes use HM Revenue and Customs’ (HMRC’s) Government Gateway system. HMRC has been updating Government Gateway, and its successor (the Secure Credential Platform, or SCP) has been live and running in tandem with Government Gateway since October 2017. The SCP will fully replace Government Gateway by the end of February 2019.

1.13 GDS and the Cabinet Office did not mandate the use of Verify at an early stage. Departments were able to continue using other identity verification systems. HMRC, for example, offers Verify alongside its own Government Gateway system for many online services aimed at individuals. HMRC told us it did not adopt Verify for all of its services, in part because Verify cannot deal with business customers or agents acting on behalf of others. HMRC also had a pressing need to reduce customer contact by encouraging customers to adopt new online services it had built, some of which were only online, and it felt the early iterations of Verify did not easily support that. There are similarities with the Cabinet Office’s shared services programme. Our work on shared services found that programme faced implementation difficulties because individual departments felt the central standardised solution offered did not meet their specific needs.13

1.14 Some government services have experienced problems using Verify, which has led to increased costs. Only 38% of Universal Credit claimants can successfully verify their identity online (of the 70% of claimants that attempt to sign up through Verify). This compares to the Department for Work & Pensions’ (DWP’s) original plan to use it for 90% of claimants. The low level of successful online verification has meant increased operational costs. The Department expects manual verification to cost in the region of £40 million over 10 years.14

1.15 The Department for Environment, Food & Rural Affairs (Defra) and the Rural Payments Agency started using Verify to enable customers to register for Common Agricultural Policy payments in 2014. One of Defra’s key aims in adopting Verify was to help make savings for the Department under the Common Agricultural Policy Delivery programme. However, customers found it difficult to complete the Verify process and there were also delays in rolling out the new rural payments system. As a result, the Agency reverted to using its existing customer registration process, supported by drop-in centres and a telephone helpline. This contributed to a rise in programme costs for the Agency, which were 40% higher than originally anticipated.15 Currently, 85% of customers continue to use the interim solution the Agency developed in 2014.

Verification success rate

1.16 The verification success rate measures the number of people who attempt to sign up and are successful in creating a Verify account. As of February 2019, it is currently 48%.16 The measure does not count applicants who drop out of the process before choosing a provider, for example because they do not have the required documentation to hand and decide not to proceed. On average, 30,000 new users a week had their identities verified in 2018.

1.17 The verification success rate also does not indicate whether people are able to access the government services they were attempting to use in the first place. This is because the measure effectively stops counting once an individual’s identity is successfully verified. It does not consider whether that individual can actually gain access to the service they want to use. Individuals could be prevented from doing so if their Verify account details do not match the pre-existing data that the relevant service holds on them. For instance, data from the Driver and Vehicle Licensing Agency (DVLA) showed that in 2018, 38% of people trying to access its services through Verify were able to successfully sign up for a Verify account. However, of those people who were able to set up a Verify account, 8.3% of them provided information that did not match DVLA-held data and so could not ultimately access DVLA’s services.

Estimated benefits

1.18 In October 2016, GDS forecast that Verify would generate benefits of £2.5 billion over 10 years. Of these, £873 million were due to arise in the four years from 2016-17 to 2019-20.17 In 2019, GDS lowered its estimate of the benefits expected from Verify in the same four-year period by 75%, to £217 million (Figure 4).18 The 75% reduction in benefits between the 2016 and 2019 estimates is largely due to the lower than expected take-up of Verify. Early business case estimates of benefits relied on Verify reaching target user volumes, which Verify has not achieved. For example, early business cases assumed that Verify would capture all annual PAYE users, but currently HMRC estimates that only 4% of its customers use Verify to access HMRC services.

1.19 GDS has estimated that Verify will achieve several different types of benefits. These include avoided spending by departments on building alternative identity verification systems, expected savings in resource costs and savings from reducing fraud (Figure 4). On the evidence made available to us, we have not been able to replicate or validate the benefits estimated by GDS. GDS classifies its estimated benefits as non-cash releasing benefits, which are defined as benefits resulting in departmental efficiencies but not necessarily a budget reduction (such as freeing up existing staff to be redeployed onto other work).19

1.20 The largest of Verify’s expected benefits come from avoided building costs. GDS reports that between 2012-13 and 2014-15, Verify delivered savings of £111 million for avoided building costs relating to Universal Credit, an average of £37 million per year. These savings were validated by Cabinet Office internal audit but have not been independently audited by the NAO. GDS has continued to claim avoided building costs of £37 million each year from 2015-16 to 2019-20.

8 Cabinet Office, Identity Assurance (IDA) Programme Business Case, (revised for FY 2013-14), version 2.0, p. 3 and p. 20.

9 In March 2011, the Public Expenditure Sub-committee on Efficiency and Reform (PEX(ER)) mandated the development of a consistent, customer-centred approach to digital identity assurance across all services. In July 2013, PEX(ER) gave approval to build the Verify platform.

10 Government Digital Service, GOV.UK Verify Programme Business Case, version 10, October 2016, pp. 12-13.

11 Government Digital Service, GOV.UK Verify Dashboard webpage: ‘How many users have signed up to use GOV.UK Verify’, accessed February 2019. Available at: https://www.gov.uk/performance/govuk-verify/total-signups.

12 Infrastructure and Projects Authority, Identity Management – Verify: Assurance of Action Plan (AAP), July 2018.

13 Comptroller and Auditor General, Shared service centres, Session 2016-17, HC 16, National Audit Office, May 2016; Comptroller and Auditor General, Update on the Next Generation Shared Services Strategy, Session 2013-14, HC 1101, National Audit Office, March 2014; Comptroller and Auditor General, Efficiency and reform in government corporate functions through shared service centres, Session 2010-12, HC 1790, National Audit Office, March 2012.

14 Comptroller and Auditor General, Rolling Out Universal Credit, Session 2017–19, HC 1123, National Audit Office, June 2018, p. 57.

15 Comptroller and Auditor General, Early review of the Common Agricultural Policy Delivery Programme, Session 2015-16, HC 606, National Audit Office, December 2015 pp. 7 and 17.

16 Government Digital Service, GOV.UK Verify Dashboard webpage: ‘Verification success rate’, accessed February 2019. Available at: https://www.gov.uk/performance/govuk-verify/verification-success-rate.

17 Government Digital Service GOV.UK Verify Programme Business Case, version 10, October 2016, Annex E, p. 10.

18 Percentages and figures may not align due to rounding.

19 Infrastructure and Projects Authority, Guide for Effective Benefits Management in Major Projects, October 2017, p. 27; HM Treasury, Guide to developing the Project Business Case, 2018, p. 24.

Part Two

Costs and funding

2.1 This section sets out costs and funding arrangements for GOV.UK Verify (Verify), including the income it has received over the life of the programme.

Verify’s costs

2.2 In its 2016 business case, the Government Digital Service (GDS) expected programme costs for Verify to come to £212 million over the four years from 2016-17 to 2019-20. The actual total cost of Verify from 2011 up to September 2018 was £154 million. This figure includes payments to providers for verifying people’s identities, staff costs (including interim staff) and capital spending (Figure 5). Costs were incurred from 2011 and include the initial development costs of Verify’s predecessor Identity Assurance Programme (£1.7 million). However, £154 million is likely to be an underestimate of all costs across government, as GDS’s reported spend does not include the costs to departments of reconfiguring their systems to use Verify.

2.3 The largest category of costs (38%) is the payments made to commercial providers. There are two types of payments to providers: an initial payment for successfully signing up a user, and an annual fee payable for each year the user account remains active. Under previous contracts, the price paid to different providers for each user signed up varied because each provider contract was negotiated separately. In 2015 and 2016, GDS anticipated that the price paid for each user verification would decrease over time as the number of users increased. Instead, the average price paid for an identity verification at level of assurance 2 (see Appendix Two) remained stable above £20 for each year from 2013-14 to 2018-19. The overall average price paid for a new LOA2 verification over this time period was approximately £22.

2.4 GDS has revised its pricing in its new contracts, which apply from October 2018 to March 2020. Providers now receive a lower price for each user sign-up, with the contracts providing for further price reductions in increments as user volumes increase. One of GDS’s performance indicators for Verify is this expected fall in the cost of new verifications. By April 2020, it aims for the delivery of Verify to become cost-neutral. For this target to be met, the cost of verifying identities needs to fall by 95% by that time.

Funding arrangements

2.5 Between 2011-12 and 2015-16, Verify and its predecessor Identity Assurance Programme were funded primarily by the National Cyber Security Programme (NCSP). Since the 2015 Spending Review, central funding has been provided by the Cabinet Office, HM Treasury and the NCSP. In September 2018, DWP contributed funding of £12 million to maintain Verify until March 2020.

2.6 GDS also created a recharge mechanism to generate income from departments for their use of Verify. This was required under the terms of the Cabinet Office’s Spending Review 2015 funding settlement. GDS anticipated that as more people signed up to Verify, income from departments would replace the majority of central funding. GDS planned to charge departments and agencies £1.20 per year for each user who accessed their services through Verify.

2.7 In October 2016, GDS estimated that the income generated by Verify from departments, agencies and local authorities would be £19 million in 2017-18, or 32% of forecast costs.20 In 2017-18, the amount actually billed to departments and bodies was £1.3 million, due to lower than expected service take-up.

2.8 The Cabinet Office has raised invoices for departments’ use of Verify on behalf of GDS, but only one department has paid. HMRC paid a total of £6.7 million for using Verify from 2015-16 to 2017-18.21 The Cabinet Office issued invoices to six other departments or agencies from 2016-17 to 2018-19: DWP, Defra, DVLA, the Driver and Vehicle Standards Agency (DVSA), the Department for Business, Energy and Industrial Strategy (BEIS) and the Home Office. The total amount due from these six bodies came to £2 million, but so far no payment has been received. It is not clear why these invoices have remained unpaid, as the Cabinet Office told us it received no responses from the departments and agencies concerned after issuing the invoices. DVLA and DVSA have advised us they had no record of having received the original Verify invoices (DVSA’s original invoices had been sent to the wrong address). The Cabinet Office has now resent the invoices to DVLA and DVSA.

20 Government Digital Service, GOV.UK Verify Programme Business Case, version 10, October 2016, p. 35. To date, no local authorities have decided to use Verify.

21 This figure includes VAT.

Part Three

Decisions on Verify’s future

3.1 This part of the report considers decision-making on GOV.UK Verify (Verify) and future plans, including key uncertainties about Verify’s future operation.

Decision-making on Verify

3.2 There have been a number of key decisions and events during Verify’s lifetime, including business cases and reviews (Figure 6).

3.3 The Government Digital Service (GDS) has produced five business cases on Verify and its predecessor Identity Assurance Programme since 2011. Business cases and associated funding bids were subjected to approval processes within both HM Treasury and the Cabinet Office. As the programme evolved, GDS revised the expectations and planning assumptions in its business cases. For example, the 2014 business case expected 100 government services to migrate to Verify’s predecessor; by 2015, this expectation had halved to 50 services adopting Verify, and by 2016 had reduced further to 46. However, all of GDS’s business cases consistently concluded there was a positive economic justification to proceed or continue with Verify on cost-benefit grounds, and decisions to approve business cases were agreed by HM Treasury and the Cabinet Office.

3.4 Verify has been reviewed over 20 times by internal and external bodies. Most of the reviews were commissioned by the Cabinet Office and the Infrastructure and Projects Authority (IPA). The number of reviews in part reflects efforts by GDS to re-evaluate and reset the programme. For example, in 2017 the Cabinet Office commissioned an external strategic review looking at the wider long-term benefits of the digital identity market for government and the UK economy. The IPA carried out reviews of Verify most recently in March and July 2018, and the July 2018 IPA review indicated that “successful delivery of the project appears to be unachievable”. The review concluded that prospects for Verify’s ability to improve performance and increase user numbers were “very bleak”. It recommended that Verify be closed as quickly as practicable, bearing in mind the critical dependency of Universal Credit.22

Government decisions on Verify’s future

3.5 Major decisions on Verify’s future were made in 2018. In May 2018, the Cabinet Office and HM Treasury approved a ‘reset’ of Verify, following work by the Cabinet Office and GDS during 2017 to explore this option. The reset involved tests, recommended by the IPA and adopted by the Chief Secretary to the Treasury, to judge whether Verify had improved performance and take-up. These tests required GDS to demonstrate by June 2018 that:

Verify’s level of assurance 1 (LOA1) product was viable. This involved GDS working with the Department for Work & Pensions (DWP), HM Revenue & Customs (HMRC) and the Driver and Vehicle Licensing Agency (DVLA) to explore using LOA1 verifications for services such as Universal Credit and personal tax accounts; and

Verify had the necessary buy-in from departments to future development and wider roll-out in their core business operations.

3.6 On the first test, the IPA July 2018 review of Verify found that introducing LOA1 verifications had not attracted other government departments’ support, driven up volumes or lowered costs.23 On the second test, GDS sought assurances from DWP, HMRC and DVLA regarding their commitment to Verify. Ultimately only DWP committed to continuing to use Verify given Universal Credit’s dependency on it for LOA2 verifications. At the time (June 2018), DVLA said it was committed to working with GDS to understand the extent to which Verify’s LOA1 verifications met DVLA’s needs. Its position was that any decision to use Verify for additional DVLA services would depend on customer and service needs. HMRC told us it worked closely with GDS to determine whether the LOA1 credential met the same standard of verification as its own Government Gateway process, and to ensure any effort to either uplift LOA1 or integrate it had a minimal impact on delivery teams. However, it did not reach an agreement with GDS before the IPA review in July 2018.

3.7 Given that the reset tests were not met, in October 2018 the Cabinet Office announced that:24

government funding to Verify will stop in March 2020. Government has capped the amount it will spend on Verify during this time to £21.5 million;

the government has stated that from April 2020, providers will be responsible for investing to ensure the delivery of Verify and broadening the usage and application of digital identity in the UK; and

new 18-month contracts with existing providers have been introduced from October 2018 to cover the transition period. The contract renewals set out reduced payment rates to providers for identity verification (see Part Two).

Future uncertainties

3.8 There are some key uncertainties about Verify’s future operation:

Cost to departments of using Verify. From April 2020, GDS has said Verify will become a private sector-led model, and it is currently considering what that commercial model will involve. One possibility is that departments would procure and pay for Verify’s services directly from providers. It is not clear what price would be charged for verifying identities, as this would be set by the new market. As a result, departments using Verify lack certainty over the cost of using Verify in the future.

Future demand. It is not yet clear how strong the future demand for Verify will be from government services. Departments told us they are adopting a ‘wait and see’ approach before committing to using Verify after 2020. GDS did not provide analysis of likely future demand for Verify from government services, or how any price changes might affect services’ willingness to use Verify in future.

The greatest uncertainty concerns DWP, which is Verify’s biggest government customer because of Universal Credit. However, problems Universal Credit claimants have experienced with Verify (see para 1.14) mean most of them cannot use Verify to apply for Universal Credit. GDS is working with DWP on an improvement plan to increase the number of claimants successfully verified. At January 2019, DWP expected Verify to be part of the picture for Universal Credit in future, depending on the outcomes of the improvement plan.

Users signed up with providers leaving Verify. Five out of the original seven providers remain following the contract renewals. The five staying are Barclays, Digidentity, Experian, Post Office and secureidentity/Morpho; the two leaving are Royal Mail and CitizenSafe/GBG. It is uncertain what will happen to users signed up with the two providers that have decided to leave Verify, who have approximately 380,000 users between them. It is likely these users will be offered the opportunity to sign up again, but they will not transfer automatically to one of the remaining providers and government will have to pay again if they rejoin as Verify users.

GDS priorities

3.9 In November 2018 GDS set up a cross-departmental governance board for Verify called the Secure Government Services Board, with membership from the Department for Digital, Culture, Media & Sport (DCMS), DWP, HMRC, DVLA, the Home Office, HM Treasury and the National Cyber Security Centre. This is intended to support Verify’s delivery and ensure it can be “optimised” for Universal Credit. The board is also looking at the data and standards needed to underpin an effective digital identity market, and how to ensure Verify works with international identity schemes.

3.10 One of GDS’s key priorities is supporting the development of a digital identity market that spans both public and private sectors. Its vision is for Verify users to be able to use their verified identity accounts for private sector transactions as well as government services. GDS is working with DCMS on mechanisms to support market development, including updated government digital identity standards and a certification framework. GDS and DCMS are also coordinating with the Home Office so that government identity data can be safely queried in the public and private sectors.

3.11 The IPA plans to conduct a concluding review of Verify as it comes to the end of its time as a government project. This will consider the evidence underpinning GDS’s assumptions that a move to a private sector-led model is a viable option for Verify. The review also intends to look at potential impacts on departmental Verify users, particularly for the smaller services that may not have developed alternative identity verification options.

22 Infrastructure and Projects Authority, Identity Management – Verify: Assurance of Action Plan (AAP), July 2018.

23 See footnote 22.

24 House of Commons, ‘GOV.UK Verify programme: written statement’, HCWS978, 9 October 2018. Available at: www.parliament.uk/business/publications/written-questions-answers-statements/written-statement/Commons/2018-10-09/HCWS978/.

Appendix One

Our investigation approach

Scope

1 Our conclusions on Verify were reached following analysis of evidence collected between November 2018 and February 2019. Our main methods are outlined below.

2 At a late stage, the Cabinet Office and GDS raised concerns about unspecified inaccuracies, but did not communicate what these were. To the best of our knowledge, the information in the report is accurate.

Document review

3 We reviewed key documents including:

Government Digital Service (GDS) business cases and supporting documents;

Infrastructure and Projects Authority (IPA) reviews;

standards documents and guidance for departments and commercial providers;

GDS data on performance, costs and benefits;

minutes and papers from meetings of governance bodies;

documentation setting out the objectives and development of Verify; and

HM Treasury and Cabinet Office documentation on funding.

Interviews

4 We conducted semi-structured interviews with the Cabinet Office, Department for Digital, Culture, Media & Sport (DCMS), Driver and Vehicle Licensing Agency (DVLA), GDS, HM Revenue & Customs (HMRC), IPA, and the Department for Work & Pensions (DWP).

5 We also conducted semi-structured interviews with commercial identity providers, both current and departing: CitizenSafe/GBG, Digidentity, Experian, Post Office, Royal Mail and secureidentity/Morpho.

Quantitative analysis

6 We undertook quantitative analysis of data on programme costs (forecast and actual), benefits, payments to providers and funding. We also analysed performance data on user and service take-up.

Appendix Two

Standards-based identity proofing

1 This Appendix sets out examples of the information needed to verify people’s identities at different levels of assurance. Identity verification is mainly undertaken at level of assurance 2 for Verify, although some verifications occur at level of assurance 1.

2 Identity providers use the Cabinet Office and GDS’s identity proofing and verification (IPV) standards to verify a person’s identity.25 There are five criteria to be fulfilled. The level of assurance required dictates which criteria need to be fulfilled and the information the applicant needs to provide.

25 Cabinet Office and Government Digital Service, Good Practice Guide (GPG) 45: Identity Proofing and Verification of an Individual, version 3.0, February 2017.

Design and Production by NAO External Relations
DP Ref: 006469-001