The government’s preparedness for the COVID-19 pandemic: lessons for government on risk management

Cross-government

REPORT

by the Comptroller
and Auditor General

Session 2021-22

19 November 2021

HC 735

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2020, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £926 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

The government’s preparedness for the COVID-19 pandemic: lessons for government on risk management

Cross-government

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 17 November 2021

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

15 November 2021

Value for money reports

Our value for money reports examine government expenditure in order to form a judgement on whether value for money has been achieved. We also make recommendations to public bodies on how to improve public services.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

009200 11/21 NAO

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Leon Bardot, John Fellows, Sophie Jones, Phillip Li, Elisabeth Moore, Pauline Ngan, Peter Sturgess, Alberto Vanzo, under the direction of Siân Jones and Mfon Akpan.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Summary

Introduction

1 The UK government and devolved administrations, along with the emergency services and other local responders, have clear responsibilities for identifying, assessing, preparing for and responding to emergencies, as well as supporting affected communities to recover. The government has risk management processes in place that aim to identify risks, to ensure that plans are drawn up to mitigate risks and prepare for shocks, and to prevent risks from being overlooked despite short-term pressures. Cabinet Office guidance states that preparedness is the preparation of plans that are flexible enough both to address known risks and to provide a starting point for handling unforeseen events.

2 The scale and nature of the COVID-19 pandemic and the government’s response are without precedent in recent history. Many people have died, and many lives, families and businesses have been adversely affected. By the end of July 2021, the estimated lifetime cost of measures announced as part of the government’s response was £370 billion. The pandemic has tested the government’s plans to deal with unforeseen events and shocks, and demonstrated the risks that exist to which UK citizens are exposed. Like many other governments across the world, the UK government was underprepared for a pandemic like COVID-19. It will need to learn lessons from its preparations for and handling of whole-system risks, which will include making judgements on what level of preparations is appropriate.

3 Emergencies can take many forms, such as natural disasters, terrorist attacks, industrial accidents, critical supply chain disruptions or disease outbreaks. These emergencies can have widespread impacts, such as fatalities and serious disruption to people’s lives and the national economy. Emergencies, or the risk of emergencies, can originate inside or outside the UK, exacerbate the likelihood or impact of other risks, and be felt locally, nationally or globally. In the UK, recent emergencies include the London and Manchester terrorist attacks, the ‘Beast from the East’ winter storm, serious flooding incidents and the COVID-19 pandemic.

4 The Cabinet Office, through its Civil Contingencies Secretariat (CCS), is responsible for coordinating the government’s planning for, and response to, major emergencies. Individual departments and other public sector organisations are responsible for identifying and managing risks in line with their desired risk appetite, including relevant national risks allocated to them by the Cabinet Office. For example, the Department of Health & Social Care is responsible for planning for the health and social care impacts of health-related risks. All departments are responsible for planning for emergencies that would have significant consequences in their areas of remit.

Scope of this report

5 This report sets out the facts on:

the government’s approach to risk management and emergency planning (Part One);

the actions the government took to identify the risk of a pandemic like COVID-19 (Part Two);

the actions the government took to prepare for a pandemic like COVID-19 (Part Three); and

recent developments (Part Four).

6 The report sets out central government’s risk analysis, planning, and mitigation strategies prior to the arrival of the COVID-19 pandemic, with the aim of drawing out wider learning for the government’s overall risk management approach. It does not cover local-level risk planning, wider aspects of resilience planning or top-level disaster response procedures. It also does not cover the government’s response to COVID-19 or how prepared it was for subsequent waves of the pandemic. Appendix One sets out our audit approach and provides more details on the report’s coverage.

Key findings

Government’s risk management

7 The UK government has had a national-level risk assessment in place since 2005. It assesses the most serious risks facing the UK or its interests overseas over the next two years via the National Security Risk Assessment (the Assessment). This is a classified document that contains around 120 risks and is summarised in a public-facing version, the National Risk Register (the Register). Both documents are updated regularly. Before the pandemic, in a 2019 report on the government’s risk assessment process, the Parliamentary Office of Science and Technology noted that the UK was regarded as a leader in risk assessment. In 2020, the Cabinet Office told a House of Lords committee that the Assessment’s methodology had been adopted by many countries (paragraphs 1.4 to 1.6, 2.12 and Figure 1).

8 Since before the pandemic, stakeholders have identified areas for improvement in the government’s approach to risk assessment. The Cabinet Office regards the Assessment primarily as an operational tool to help emergency planners to prepare for civil emergencies and malicious attacks. The Assessment therefore focuses on a two-year horizon and a single scenario for each risk (the reasonable worst-case scenario) to make it easier to develop detailed emergency plans. Stakeholders, including academics, the Chief Scientific Advisers’ network and the Parliamentary Office of Science and Technology, have identified several ways in which this approach might be improved, including:

that it does not sufficiently explore high-uncertainty risks (where estimating the likelihood is difficult), risks that may materialise beyond the Assessment’s two-year timeframe, and the impact that multiple risk events would have if they took place at the same time;

that it might be beneficial to consider more than one scenario in risk assessments;

how interdependencies between risks are assessed and presented;

that the focus on causes of adverse events has not been matched by a sufficiently robust assessment of their systemic effects;

the need for a cross-government view of risks to understand the knock-on effects on other parts of the system, given that risks are built up from individual departments, and to stop risks falling through the cracks between departments; and

better communication of risks and contingency plans to local responders (paragraphs 2.12 and 2.13).

9 The Cabinet Office is reviewing aspects of the methodology that it uses to assess risks to the UK. It stated that it reviews its methodology as part of its regular cycle of updating the Assessment and Register. It also told us that the current review goes into greater depth than previous reviews and considers all the issues identified in paragraph 8. The review covers the Assessment’s time horizon; the types of risks the Assessment should include; whether it would be helpful to set out multiple scenarios, rather than just the reasonable worst-case scenario; how to measure the likelihood and impact of risks; how to account for interdependencies between risks; how to visualise, present and communicate risks; how to use external inputs better; and the operating model of the Assessment, including its physical format and how frequently it is produced (paragraph 2.14).

10 A recent review of risk management across departments by the Government Internal Audit Agency found scope for improvement by reducing variation. The review noted that risk practices have improved over time across government and that organisations are placing increased importance on the contributions of their risk functions. The review highlighted variability in senior leadership support and promotion of risk management, including at board and executive levels; capacity and engagement in relation to risk management; approaches and frequency in undertaking horizon scanning exercises; and alignment to the Orange Book, which sets out the government’s mandatory requirements and guidance on risk management. A review commissioned by the Cabinet Office recommended that a cross-government risk management profession with certification and training should be established. The government accepted the recommendation, and HM Treasury has begun work on implementation (paragraphs 2.15 and 4.2).

Identifying the risk of a pandemic like COVID-19

11 Since 2008, the Register has identified an influenza pandemic as the UK’s top non-malicious risk and an emerging infectious disease as one of the most significant risks. The 2017 Register highlighted the difficulty in forecasting the spread and impact of a new influenza strain or disease until it starts circulating, but noted that the consequences may include, for an influenza pandemic: up to half of the UK population experiencing symptoms, potentially leading to between 20,000 and 750,000 fatalities and high levels of absence from work; and, for emerging infectious diseases (such as Ebola at the start of the 2004–2006 outbreak in West Africa): several thousand people experiencing symptoms, potentially leading to up to 100 fatalities (paragraphs 2.2 to 2.5).

12 Prior to the pandemic, the Department of Health & Social Care had identified a pandemic as a significant risk to its operations or policy delivery responsibilities, while other departments identified risks relating to possible consequences or impacts of a pandemic. The Department of Health & Social Care identified a specific risk relating to a pandemic or infectious disease as a top-level risk. Five other departments identified broader risks relating to external threats or lack of resilience, which encompass a pandemic, among other scenarios. The remaining departments identified risks that capture some consequences or impacts of a pandemic, such as economic slowdown, funding shortfalls, impacts on operational performance, staff well-being and supplier failure (paragraph 2.7 and Figure 4).

13 At the local level, all community risk registers had identified an influenza pandemic as a significant risk prior to the pandemic. Multi-agency groups, known as ‘local resilience forums’, are responsible for local-level emergency planning, including compiling community risk registers. All 38 forums covering England had identified an influenza pandemic as a significant risk that could affect their local communities in their community risk registers. In addition, 17 had identified emerging infectious diseases as a significant risk (paragraph 2.11 and Figure 5).

Preparations for a pandemic like COVID-19

14 The government prioritised preparedness for two specific viral risks that it considered most likely and some preparations for these risks were adapted to the COVID-19 response. The UK government made preparations for an influenza pandemic and for an emerging high-consequence infectious disease. The latter is a very infectious disease that typically causes the death of a high proportion of the individuals who contract it, or has the ability to spread rapidly, with few or no treatment options, like Ebola and the Middle East respiratory syndrome (MERS). This meant that the government did not develop a specific pandemic preparedness plan for a disease with characteristics like COVID-19, which has an overall lower mortality rate than Ebola or MERS and widespread asymptomatic community transmission. The Cabinet Office told us that scientists considered such a disease less likely than a pandemic influenza or a high-consequence infectious disease. However, some mitigations in place were used – for example, the personal protective equipment stockpile. Many other countries had also prepared for an influenza pandemic rather than another type of pandemic (paragraphs 3.2 to 3.5, 3.8, 3.9 and 3.21).

15 The government was not fully prepared for the wide-ranging impacts that this pandemic had on society, the economy and essential public services. The 2019 Assessment recognised that an influenza-type pandemic could have extensive non-health impacts, including on communications, education, energy supplies, finance, food supplies and transport services. The government lacked detailed plans for several aspects of its response to COVID-19, including shielding, employment support schemes and managing the disruption to schooling (paragraph 3.12).

16 Prior to the pandemic, the government did not explicitly agree what level of risk it was willing to accept for an event like COVID-19. While departments set their risk appetite in response to the pandemic, we did not see evidence that, before the onset of COVID-19, the government had reached a consensus on its overall risk appetite in relation to a pandemic by explicitly accepting a specific level of residual risk. The Cabinet Office told us that, as the pandemic started, the government’s risk appetite changed, and it lowered the threshold for the health and societal impacts of the pandemic that it deemed acceptable (paragraph 3.7).

17 A cross-government review of pandemic planning arrangements found that most plans were inadequate to meet the demands of any actual incident. A review of pandemic planning arrangements, carried out by a cross-government working group in February and March 2020, rated 82% of plans as being unable to meet the demands of any actual incident. There is limited oversight of plans or assurance that they are effective and up to date. For example, the CCS does not have the remit to carry out formal assurance work over lead departments’ plans for emergency preparedness and response. Its officials told us that it brings pressure to bear on departments if it thinks risks are not dealt with properly. The then Ministry of Housing, Communities & Local Government told us that, while its liaison officers support and challenge local resilience forums, their role is obtaining reassurance rather than formal assurance over local resilience forums’ readiness for emergencies (paragraphs 3.13 to 3.15).

18 Prior to the pandemic, the government did not act upon some warnings about the UK’s lack of preparedness from its past pandemic simulations. The government has taken forward many lessons learned from actual incidents and simulation exercises. For instance, it revised pandemic plans following Exercise Winter Willow and it prepared a draft Pandemic Influenza Bill, which was the basis for the Coronavirus Act, following Exercise Cygnus (2016). Other lessons were not fully implemented. Exercise Winter Willow, a large-scale pandemic simulation exercise carried out in 2007, warned that organisations needed to ensure that their business continuity plans were better coordinated with those of their partner organisations, but this was not evident in most plans we reviewed. The government’s own review of pandemic plans in place at the start of the COVID-19 pandemic found that only 12% of the plans (9 out of 76) mostly or fully considered mitigating actions for the loss of suppliers or delivery partners (paragraphs 3.18 to 3.20 and Figure 8).

19 Preparations for EU Exit had significant benefits in responding to the pandemic but diverted resources from other risk and contingency planning. Government officials stated that preparations for EU Exit enhanced the crisis capabilities of some departments and that the government was able to apply lessons it had learned about central coordination of an area of risk (EU Exit) when responding to the pandemic. However, major risk planning for EU Exit contingencies across the civil service took up significant time and resources and meant that the government paused work on other emergency preparations. For example, the CCS allocated 56 of its 94 full-time equivalent staff to prepare for potential disruptions from a no-deal exit, limiting its ability to focus on other risk and contingency planning at the same time. This raises a challenge for the government as to whether it has the capacity to deal with multiple emergencies or shocks (paragraphs 3.16 and 3.17).

Conclusion

20 This pandemic has exposed a vulnerability to whole-system emergencies – that is, emergencies that are so broad that they engage the entire system. Although the government had plans for an influenza pandemic, it did not have detailed plans for many non-health consequences and some health consequences of a pandemic like COVID-19. There were lessons from previous simulation exercises that were not fully implemented and would have helped prepare for a pandemic like COVID-19. There was limited oversight and assurance of plans in place, and many pre-pandemic plans were not adequate. In addition, there is variation in capacity, capability and maturity of risk management across government departments.

21 The pandemic has highlighted the need to strengthen the government’s end-to-end risk management process to ensure that it addresses all significant risks, including interdependent and systemic risks. This will require collaboration on risk identification and management not only across government departments and local authorities, but also with the private sector and internationally. For whole-system risks the government needs to define its risk appetite to make informed decisions and prepare appropriately so that value for money can be protected. The pandemic has also highlighted the need to strengthen national resilience to prepare for any future events of this scale, and the challenges the government faces in balancing the need to prepare for future events while dealing with day-to-day issues and current events.

Recommendations

22 The government has already started to think about addressing many of these issues – for example, through its National Resilience Strategy, and our recommendations aim to support the government’s learning from the pandemic on risk management and preparedness:

a The Cabinet Office should establish who leads and manages whole-system risks. Working with other departments, it should clarify and publicise the government’s risk appetite for whole-system emergencies as a basis for proportionate planning across government for these types of risk event.

b The Cabinet Office should support government departments to take stock of how funding for risk management and national resilience is prioritised and managed. There should be deliberate consideration of the investment required to ensure that risk management and national resilience have an appropriate level of funding and resourcing compared with other national and departmental priorities, at both departmental and central government levels.

c The Cabinet Office should work with government departments to ensure that their risk management, business continuity and emergency planning are more comprehensive, holistic and integrated. This involves ensuring that the government can rely on timely and good-quality data in the event of a major emergency; improving coordination and information sharing between the CCS and risk managers in departments; applying best practice in risk management, horizon scanning, stress-testing and business continuity and emergency planning; collaborating both internationally and with the private sector to identify and manage cross-economy risks and global interdependencies; and considering what broader aspects of national resilience need to be strengthened to ensure that the residual risk is in line with the government’s risk tolerance.

d The Cabinet Office should strengthen oversight and assurance arrangements over preparations for system-wide emergencies. These should include publishing standards against which lead government departments, supporting departments and other public sector organisations can assess their level of preparedness for major emergencies, developing external assurance processes to assess, on a regular basis, whether there are adequate preparations in place that meet those standards and can be activated rapidly in the event of an emergency, and ensuring that all departments that are involved in the response to whole-system or catastrophic risks have coordinated plans that cover the whole range of societal and wider impacts.

e The Cabinet Office and other government departments should ensure that lessons from simulation exercises are communicated and embedded across government. Simulation exercises are an effective way to spend resources to improve the management of low-probability high-impact risks, but lessons learned must be promptly disseminated and implemented to achieve value from undertaking these exercises.

f The Cabinet Office and HM Treasury should support departments to reduce variation in capacity, capability and maturity of risk management, emergency planning and business continuity across government departments. This should include providing advice on strengthening leadership of risk management, business continuity and disaster recovery; the basic level of capability needed in each department; and plans to address any gaps.

Part One

The UK government’s approach to risk
management and emergency planning

1.1 Emergencies can take many forms, such as natural disasters, terrorist attacks, industrial accidents, critical supply chain disruptions or disease outbreaks. These emergencies can cause widespread impacts, such as significant disruption to people’s day-to-day lives and the national economy, as well as fatalities in the most serious events. In the UK, recent disruptive events include the London and Manchester terrorist attacks, the ‘Beast from the East’ winter storm, the use of chemical weapons in Salisbury and Amesbury, serious flooding incidents, and the COVID-19 pandemic.

1.2 Emergencies, or the risk of emergencies, may originate inside or outside the UK, exacerbate the likelihood or impact of other emergencies, and be felt on a local, national or global scale. The UK government and devolved administrations, along with the emergency services and other local responders, have clear responsibilities for identifying, assessing, preparing for and responding to risks, as well as supporting affected communities to recover.1

1.3 This part sets out the government’s approach to risk management and how this applies to its preparedness for events such as COVID-19. It covers:

national assessment of risk;

emergency planning; and

roles and responsibilities.

National assessment of risk

1.4 The government assesses the most serious risks facing the UK or its interests overseas via the National Security Risk Assessment (the Assessment).2 This is a classified document that was first published in 2010, contains around 120 risks and is summarised in a public-facing version, the National Risk Register (the Register) (Figure 1). The Civil Contingencies Secretariat (CCS), within the Cabinet Office, is responsible for coordinating the production of the Assessment and Register. This involves working closely with a wide range of stakeholders, including other UK government departments, devolved administrations, the government scientific community, intelligence and security agencies, and a range of independent experts such as industry partners and academics.3 The latest Assessment and Register were published respectively in 2019 and 2020. An updated version of the Assessment is due to be available in 2022.

1.5 The Assessment and Register set out the most significant emergencies that the UK and its citizens could face over the next two years, including environmental hazards; risks to human and animal health; malicious attacks; major accidents; societal risks; and serious and organised crime.4 They consider risks that:

could potentially damage the safety or security of the UK or its interests both domestically and overseas, including both episodic risks (such as cyberattacks) and chronic risks (such as poor air quality). While the Assessment considers longer-term trends that might have an impact on risks, such as climate change,5 it does not feature long-term risks as standalone risks. It also does not cover risks to the achievement of the government’s plans, strategies and goals. This reflects the fact that the Cabinet Office sees the Assessment and Register as tools to aid emergency planning, as opposed to overall risk management or long-term policy setting.

have national significance, as opposed to localised risks such as landslides. Community risk registers, prepared by local resilience forums, consider the likelihood and potential impact of the main risks affecting specific areas of England and Wales;6 and

meet certain thresholds for impact and likelihood. These include risks with a 1 in 100,000 annualised likelihood of occurring over the next two years but may include risks with a lower likelihood if this is deemed helpful to support emergency planning. The Cabinet Office noted that the Assessment includes risks under review and takes account of some emerging risks. Risks that do not meet the threshold for inclusion are assigned to specific departments or arm’s-length bodies, which keep them under review.

1.6 The Assessment uses historical and scientific data and the professional judgements of experts to analyse the risks to the UK. It does not attempt to detail every possible hazard or threat that could affect a significant part of the UK but tries to capture a wide range of impacts, including fatalities, economic cost to the UK, disruption to essential services, environmental damage, security impacts, damage to the international order and public perception. There are three stages to this analysis:

identification of risks. Risks are included if they either appeared on the previous Assessment and nothing has changed since, or if something new or different has been identified, either by a risk-owning department or the CCS;

assessment of the likelihood of the risks occurring and their impact if they do. Each risk is owned by a government department or arm’s-length body, which carries out initial assessments of impact and likelihood based on a reasonable worst-case scenario (Figure 2). The CCS provides the departments and arm’s-length bodies who own the risks with a common set of assessment standards, and instructions and compiles risk estimates; and

comparison of the risks. The likelihood and impact for each worst-case scenario are then plotted on the same graph, permitting direct comparison (Figure 2).

1.7 The 2019 Assessment was prepared and reviewed as follows:

Departments and arm’s-length bodies identified risks and the Cabinet Office reviewed them to ensure that they met inclusion criteria for the Assessment and were representative of the whole risk landscape.

Departments and arm’s-length bodies that owned each risk developed reasonable worst-case scenarios with input from internal and external experts.

The CCS facilitated challenge of the reasonable worst-case scenarios by convening groups of internal and external experts from academia and industry.

Departments updated their reasonable worst-case scenarios, with the involvement of their Chief Scientific Advisers.

The CCS reviewed the updated reasonable worst-case scenarios, scored their impact and likelihood and compiled the Assessment.

The Deputy National Security Adviser and the Government Chief Scientific Adviser reviewed the Assessment.

Relevant ministers and the Prime Minister signed off the Assessment.

1.8 Emergencies can have very complex knock-on effects, given the increasingly complex and interdependent nature of society. The Assessment and Register identify both direct and indirect consequences, common to several risks. The Register also notes four long-term trends that might bring about changes in risks affecting the UK: climate change, health and demographics, geopolitics and technology. The Cabinet Office has stated that the government also uses the Assessment to help inform the spending reviews so that spending to prepare for emergencies can be appropriately prioritised.

1.9 The common consequences of all risks are drawn together at the end of the Assessment to form 24 emergency planning assumptions. These assumptions describe the maximum expected scale, duration and severity of each common consequence of the risks set out in the Assessment, such as the maximum expected disruption to education, emergency services, transport and communications. They inform the Resilience Capabilities Programme, run by the CCS, which aims to improve the UK’s capability to respond to, and recover from, civil emergencies. Under this programme, government departments that own the different capabilities are responsible for building resilience in those areas. In a comparative review of national risk assessments, the Organisation for Economic Co-operation and Development (OECD) praised this approach because it provides a consistent basis for assessing which capacities may be required to insure against the worst-case outcomes of a wide range of hazards and threats.7 The programme is split into several work streams, including one for human infectious diseases. The governments of Scotland, Wales and Northern Ireland may also take the Assessment into account in conducting their own assessment of risks.

Emergency planning

1.10 Understanding the risks and determining their potential impact and likelihood is the starting point for emergency planning. As the Register has noted, the key to turning this into useful planning information is remembering that it is not the risks themselves that people deal with when things go wrong, but their consequences.8

1.11 Government departments and agencies can use the emergency planning assumptions in the Assessment to assess whether existing plans, infrastructure, equipment, supplies and training are adequate (Figure 3). The Assessment also informs local emergency planning. It provides a range of risks, assumptions and scenarios that local resilience forums can use to consider their local preparedness. These forums are groups of responders, tasked with assessing local risks, compiling community risk registers, and preparing and validating emergency plans in compliance with their statutory responsibility for local-level emergency planning (Figure 3).9 They are not organisations and have no dedicated funding.10 They consider the impact of both malicious and non-malicious risks, and may establish specific risk assessment sub-groups to manage them. The CCS provides guidance detailing how risks should be evaluated so that community risk registers are broadly comparable. In some cases, local groups must identify and assess geographically specific risks not included in the Assessment, such as landslides. The Department for Levelling Up, Housing & Communities’ resilience advisers support forum members on specific risks and ensure that risks identified at the local level are shared with central government to inform policy and operational support. The Local Resilience Forum National Risk Working Group engages local risk experts across England on risk and gives local resilience forums the opportunity to discuss local risks with central government.

1.12 The UK adopts a bottom-up approach to managing emergencies, based on the principle that “decisions should be taken at the lowest appropriate level with coordination at the highest necessary level”.11 Most emergencies, such as flooding, industrial incidents and major road crashes, only affect local areas. Local responders manage them without the direct involvement of central government. In some instances, the scale or complexity of an emergency means that some degree of central government support or coordination becomes necessary. A designated lead government department or, when appropriate, a devolved administration is made responsible for the overall management of the central government response. In the most serious cases, the central government response is coordinated through the Civil Contingencies Committee (known as ‘COBR’), a Cabinet Committee that is convened when needed to deal with major crises.

Roles and responsibilities

1.13 There are different roles and responsibilities on risk management across government (Figure 3):

The Cabinet Office coordinates government’s planning for, and response to, major emergencies through its CCS.

Each risk in the Register is allocated to a lead department. Each department has its risk register that may include relevant risks from the Register as well as risks that are specific to that department.

At the local level, local authorities are part of multi-agency groups (local resilience forums) that coordinate emergency planning, including compiling community risk registers.

1.14 During each cycle of producing the Assessment and Register, the CCS engages with departments to understand what new risks may need to feed into the Assessment. It also engages with local resilience forums where the forums can highlight risks that they have identified but that may not be captured nationally.

1.15 Individual departments and other public sector organisations are responsible for identifying and managing risks in line with their desired risk appetite,12 including relevant national risks allocated to them by the Cabinet Office and risks set out in the Register that are relevant to their operations. Ultimate responsibility for risk management lies with the board and accounting officer, who should ensure that organisations allocate appropriate resources (people, skills, experience and competence) to risk management. They are supported by audit and risk committees, functional leads, and risk and business continuity practitioners. HM Treasury sets the standards, requirements and guidance for risk management, with developments and engagement supported through the Government Finance Function (a cross-government group led by HM Treasury). In practice, risk practitioners across this community are not wholly located within finance divisions. Business continuity practitioners are often located in departments’ security divisions.

1.16 The government’s Orange Book, produced by the Government Finance Function, sets out principles-based mandatory and advisory standards for risk management, informed by relevant standards and good practice. All departments are expected to apply the principles that risk management should be:

an essential part of governance and leadership, and fundamental to how the organisation is directed, managed and controlled at all levels;

an integral part of all organisational activities to support decision-making in achieving objectives;

collaborative and informed by the best available information and expertise;

structured to include risk identification and assessment to determine and prioritise how risks should be managed; the selection, design and implementation of risk treatment options that support achievement of intended outcomes and manage risks to an acceptable level; the design and operation of integrated, insightful and informative risk monitoring; and timely, accurate and useful risk reporting to enhance the quality of decision-making and to support management and oversight bodies in meeting their responsibilities; and

continually improved through learning and experience.13

1 HM Government, National Risk Register: 2020 edition, December 2020.

2 Prior to 2019, the UK had two overarching risk assessments: the National Risk Assessment, first published in 2005, and the National Security Risk Assessment, published in 2010 and 2015. Since 2019, these have been combined into a single risk assessment, bringing together domestic, international, malicious and non-malicious risks.

3 HM Government, National Risk Register: 2020 edition, December 2020.

4 The 2020 Register covers a two-year horizon but previous versions covered a five-year horizon.

5 The Assessment considers specific events that may be partly caused by climate change, such as heatwaves. The Climate Change Committee’s UK Climate Risk Independent Assessment, published every five years, covers risks related to climate change.

6 Similar forums exist in Northern Ireland (emergency preparedness groups) and Scotland (regional and local resilience partnerships).

7 OECD, National Risk Assessments: A Cross Country Perspective, revised edition, October 2018.

8 HM Government, National Risk Register: 2008 version, July 2008.

9 The Civil Contingencies Act, together with supporting regulations and guidance, sets out the responsibilities of local responders for preparing for and responding to emergencies.

10 The government is carrying out a local resilience forum funding pilot in 2021-22.

11 Cabinet Office, Responding to Emergencies: The UK Central Government Response Concept of Operations, March 2010.

12 HM Treasury, Managing Public Money, May 2021.

13 HM Government, The Orange Book: Management of Risk – Principles and Concepts, October 2020.

Part Two

Identifying the risk of a pandemic like COVID-19

2.1 This part sets out:

what action the government took to identify a risk like the COVID-19 pandemic;

the extent to which a pandemic features in departmental and local risk registers; and

potential areas for improvement in the government’s approach to risk identification.

National risk identification of a pandemic or infectious disease

2.2 The National Risk Register (the Register) has consistently included two viral risks among the most significant emergencies that the UK could face over the next five years:14

a pandemic influenza; and

new and emerging infectious diseases.

2.3 The 2017 Register identified pandemic influenza as the most significant non-malicious-attack risk that was likely to materialise by 2022.15 It was estimated to be at least as likely as a variety of other risks, ranging from heatwaves to poor air quality, public disorders and volcanic eruptions, but with a more severe impact than any other non-malicious-attack risk. The Register estimated that up to half of the UK population could experience symptoms. It noted that this could lead to between 20,000 and 750,000 fatalities, and high levels of absence from work due to a lack of immunity in the population. The 2019 National Security Risk Assessment (the Assessment) acknowledged that each pandemic is different, it is not possible to anticipate the nature of the virus, when and where it will emerge and its impacts, and that pandemics significantly more serious than the reasonable worst-case scenario are possible. It set out similar caveats for emerging infectious diseases.

2.4 The 2017 Register characterised emerging infectious diseases as diseases that have recently been recognised or where cases had increased over the past 20 years in a specific place or among a specific population. It noted that more than 30 new or newly recognised emerging infectious diseases, such as Ebola, Zika and the Middle East respiratory syndrome (MERS), had been identified around the world in the previous 25 years, and that MERS was posing a global threat. The government classified all three diseases as high-consequence infectious diseases – that is, very infectious diseases that typically cause the death of a high proportion of individuals who contract it, or have the ability to spread rapidly, with few or no treatment options.

2.5 This Register placed emerging infectious diseases in the same high-likelihood category as pandemic influenza, having increased their likelihood from 2015 “in light of evidence from recent emerging infectious diseases such as Ebola and Zika”. However, it stated that these were less likely to spread within the UK than an influenza pandemic and to be less impactful, possibly leading to up to 100 fatalities and several thousand people experiencing symptoms. The Cabinet Office stated that, based on scientific and expert advice, diseases such as Ebola were expected to burn themselves out quickly, as had been the case on previous occasions.

2.6 In January 2016, toward the end of the 2014–2016 Ebola outbreak in West Africa, a Select Committee report on lessons for the UK from the outbreak criticised the use of the category of emerging infectious diseases in the Register. It noted that this category is too broad and not “sufficiently detailed to enable responders without clearance to view the National Risk Assessment to prepare adequately for the next disease outbreak”.16 It recommended using four categories (respiratory, blood-borne, vector-borne and food-borne diseases) to structure the animal diseases section of the Register. The government accepted this recommendation.17 The 2017 Register continued to employ the broad category of emerging infectious diseases, while also mentioning the four categories.

Departmental risk registers

2.7 We reviewed the top-level risk registers of the 17 main government departments, dating from July 2019 to December 2019 (Figure 4). These registers set out the most significant risks that the departments considered they were facing.

The Department of Health & Social Care, the lead government department for pandemic influenza and new and emerging infectious diseases, identified a specific risk relating to a pandemic or infectious disease as a top-level risk.18

Five other departments identified a broader risk, which applied to a pandemic among other scenarios, as a top-level risk. This was characterised as a natural hazard, business disruption, catastrophic loss of buildings and services, external threat or incident management risk.

The remaining 11 departments did not identify a pandemic or a broader risk as one of the principal risks they faced. However, in each case, at least one of their top risks was a potential impact of a pandemic, covering strategic impacts (lack of flexibility to manage a rapid change in priorities), financial impacts (fall in income or financial pressures) and operational impacts (staff well-being and sickness absences, increased demand on service delivery, inadequate performance of the technology infrastructure and supply chain risks).

2.8 We also reviewed the top-level risk registers of seven arm’s-length bodies which deal with emergencies as part of their role, dating from between July 2019 and January 2020. Of these:

Public Health England identified a pandemic influenza as a principal risk;

the Maritime and Coastguard Agency, a category 1 responder, identified a broader risk relating to major incidents as a top-level risk; and

of the remaining five bodies, three included some of the potential impacts of a pandemic (staff well-being, impacts on service delivery by the entity or its delivery partners) among their principal risks.

2.9 Departments that did not identify a top-level risk relating to a pandemic may nevertheless have identified a pandemic as a lower-level risk and may have carried out specific planning for a pandemic or its impacts even in the absence of a dedicated top-level pandemic risk. For instance, the Department for Work & Pensions told us that it regards a pandemic as an external threat, rather than as a principal risk. It briefed its Permanent Secretary and the Secretary of State for Work and Pensions on the Department’s readiness for an influenza pandemic and its executive team carried out a desktop exercise simulating an influenza pandemic in 2018. Its business continuity plan identified a pandemic illness as one of the circumstances that could affect staff availability and maintained a list of pandemic responses that could be enacted in the event of 10%, 25% and 50% absence rates.

2.10 In November 2019, the Government Finance Function prepared a summary of the principal risks identified across government, based on a review of departments’ strategic risk registers and single departmental plans, to support the work of the Civil Service Board. This board is responsible for the strategic leadership of the civil service, and aims to make sure that it works as a coherent and effective whole and has the capability to respond to any challenges, both now and in the future. The principal risks identified through this work included those arising from changes to the national and global macro-environment and incidents that require immediate and substantial responses, such as pandemic health outbreaks and public unrest.

Local risk registers

2.11 At the local level, before the COVID-19 pandemic, all 38 local resilience forums identified an influenza pandemic as a significant risk that could affect their local communities in their community risk registers (Figure 5). Many (24) noted that an influenza pandemic may have non-health impacts, such as disruption to businesses and supply chains, and reduced levels of emergency services. Almost half (17) also identified emerging infectious diseases as a significant risk affecting their local communities. Community risk registers are targeted at the public, often setting out mitigating actions that the public can undertake, such as ‘catch it, bin it, kill it’ in the case of influenza.

Areas for improvement

2.12 In a 2019 report on the government’s risk assessment process, the Parliamentary Office of Science and Technology noted that the UK was regarded as a leader in risk assessment.19 In 2020, Cabinet Office told a House of Lords committee that the Assessment’s methodology had been adopted by many countries. Local responders have found the methodology effective and useful to aid local-level planning. Since before the pandemic, stakeholders have identified several areas for improvement in the process of producing the Assessment and Register, and communicating the risks identified with the public and local planners:

The range of risks considered. Academics, the Chief Scientific Advisers’ network20 and the Parliamentary Office of Science and Technology have highlighted that the Assessment does not sufficiently explore high-uncertainty risks, where estimating the likelihood is difficult;21 include risks that may materialise beyond the Assessment’s two-year time frame;22 consider in sufficient detail the impact that multiple risk events would have if they took place at the same time (for example, the combined impact of a pandemic and a solar storm);23 or match the focus on causes of adverse events with a sufficiently robust assessment of their systemic effects.24

The assessment of risk and its visualisation. The Chief Scientific Advisers’ network, as well as individual network members, have highlighted the complexities in how risk assessment occurs and is then visualised. Potential areas for improvement include greater clarity on defining a reasonable worst-case scenario, whether more than one scenario may be needed, and how interdependencies between risks and cascading risks are assessed and presented. For example, a combination of malicious and non-malicious threats creates a challenge in terms of ranking and complexity, as does a combination of acute and chronic risks, because they are scored differently.25

Cross-government view of risk. The Chief Scientific Advisers’ network has highlighted the need for a cross-government view of risk to understand knock-on effects on other parts of the system, given that risks are built up from individual departments.26 The Organisation for Economic Co-operation and Development (OECD) has noted that, when individual departments are the main source to identify risks, the risks that do not have an obvious owner might fall through the cracks.27 A review commissioned by the Cabinet Office highlighted that risk management within government still needs to be more coordinated between departments, with a sharing of intelligence and the creation of a common appreciation of different risks.28 In addition, our recent report on oversight of arm’s-length bodies noted that risks within the totality of bodies that some departments oversaw were poorly understood, making it difficult to support the consolidation and aggregation of risks.29

Data availability. The Government Chief Scientific Adviser has highlighted the need for a data plan for each risk covering what data will be needed in an emergency, who owns it and how it will flow to those who need it.30

Communication of risks. Some local responders have stated that they would welcome greater access to the Assessment and more information on the contingency plans that central government has developed on its basis, to aid local-level planning.31

2.13 The Cabinet Office told us and the House of Lords Risk Assessment and Risk Planning Committee that some of the potential issues noted by stakeholders derive from trade-offs that the Civil Contingencies Secretariat (CCS) has deliberately made.32 The purpose of the Assessment is primarily to aid emergency planning. Because there is more uncertainty over medium- and long-term risks than over short-term risk, focusing on a two-year horizon reduces uncertainty. This enables the construction of detailed scenarios that facilitate planning. Presenting only the reasonable worst-case scenario, as opposed to a range of scenarios, facilitates planning because mitigating a specific manifestation of a risk is easier than mitigating a range of different manifestations.

2.14 The Cabinet Office is reviewing aspects of the methodology it uses to assess risks to the UK. The Cabinet Office told us that it reviews its methodology as part of its regular cycle of updating the Assessment and Register. It also told us that the current review goes into greater depth than previous reviews and considers all the issues identified in paragraph 2.12. The review covers the Assessment’s time horizon; which types of risk the Assessment should include; whether it would be helpful to set out multiple scenarios, rather than just the reasonable worst-case scenario; how to measure the likelihood and impact of risks; how to account for interdependencies between risks; how to visualise, present and communicate risks; how to better use external inputs; and the operating model of the Assessment, including its physical format and how frequently it is produced. Reviews are being carried out by the CCS, the Royal Academy of Engineering (which is involving a range of stakeholders) and the House of Lords Risk Assessment and Risk Planning Committee. These are all due to conclude in autumn 2021.

2.15 In May 2021, a review commissioned by the Cabinet Office noted that risk assessments, undertaken by accredited professionals, should be used when drawing up commercial strategies to implement crisis response. It recommended that a cross-government risk management profession with certification and training should be established.33 The government accepted the review’s recommendations, and HM Treasury has begun work on establishing a risk management profession as part of the wider Government Finance Function.

14 The 2020 edition includes these viral risks among the most significant emergencies, but its time horizon is two years rather than five.

15 The 2017 edition of the Register was the latest version published before the COVID-19 pandemic.

16 House of Commons Science and Technology Committee, Science in emergencies: UK lessons from Ebola, Second Report of Session 2015-16, HC 469, January 2016.

17 Department of Health, Government response to the House of Commons Science and Technology Committee Second Report of Session 2015-16: Science in Emergencies: UK lessons from Ebola, Cm 9236, April 2016.

18 This risk was broadly characterised as a “major national infectious disease hazard, such as a pandemic flu or other novel infection”.

19 Parliamentary Office of Science and Technology, POSTbrief 31: Evaluating UK natural hazards, April 2019.

20 The Chief Scientific Advisers’ network consists of Chief Scientific Advisers of departments and other government organisations who work together under the leadership of the Government Chief Scientific Adviser to support each other and resolve cross-departmental problems.

21 Samuel Hilton and Caroline Baylon, Risk management in the UK: What can we learn from COVID-19 and are we prepared for the next disaster?, November 2020.

22 See, for example, House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 28 April 2021.

23 Parliamentary Office of Science and Technology, POSTbrief 31: Evaluating UK natural hazards, April 2019; House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 2 December 2020, 28 April 2021 and 23 June 2021.

24 House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 9 June 2021. 

25 Joint Committee on the National Security Strategy, Oral evidence: Biosecurity and national security, 19 October 2020; House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 28 April 2021 and 23 June 2021.

26 House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 23 June 2021.

27 OECD, National Risk Assessments: A Cross Country Perspective, revised edition, October 2018.

28 Boardman review of government procurement during the COVID-19 pandemic, Cabinet Office, May 2021.

29 Comptroller and Auditor General, Central oversight of arm’s-length bodies, Session 2021-22, HC 297, National Audit Office, June 2021.

30 Joint Committee on the National Security Strategy, Oral evidence: Biosecurity and national security, 19 October 2020; House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 23 June 2021.

31 House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 19 May 2021.

32 House of Lords Risk Assessment and Risk Planning Committee, Uncorrected oral evidence: Risk assessment and risk planning, 25 November 2020.

33 Boardman review of government procurement during the COVID-19 pandemic, Cabinet Office, May 2021.

Part Three

Preparations for a pandemic

3.1 Cabinet Office guidance states that preparedness is the “preparation of plans that are flexible enough both to address known risks and to provide a starting point for handling unforeseen events”.34 This part covers:

preparations across government;

resources for risk management;

learning from previous incident and simulation exercises; and

international preparations.

Preparations across government

Preparations for a health response

3.2 Prior to COVID-19, the government’s planning prioritised preparedness for the two specific viral risks that it considered most likely, an influenza pandemic and high-consequence emerging diseases (see paragraphs 2.2 to 2.7). Preparations for an influenza pandemic involved:

National level. Under the stewardship of the Department of Health & Social Care’s Pandemic Influenza Preparedness Programme Board and the cross-government Pandemic Flu Readiness Board, a wide range of plans for the health response to an influenza pandemic. These were underpinned by emergency response, preparedness and resilience plans, the UK Biological Security Strategy and Public Health England’s Infectious Disease Strategy (Figure 6). Additionally, the government had set up expert committees to provide ethical and scientific advice in the event of an influenza pandemic. These were the Independent Scientific Pandemic Insights Group on Behaviours (SPI-B), the Moral and Ethical Advisory Group (MEAG), the Scientific Pandemic Influenza Group on Modelling (SPI-M) and the New and Emerging Respiratory Virus Threats Advisory Group (NERVTAG).35 The government maintained clinical countermeasures, such as a stockpile of antibiotics and antivirals, and had an advance purchase agreement in place for pandemic-specific vaccines. Public Health England maintained processes for monitoring seasonal influenza, that could be used in a pandemic, and a telephone service that could be activated to enable requests of antivirals over the phone without visiting a GP. The Department of Health & Social Care’s Pandemic Influenza Preparedness Programme Board oversaw these preparations.

Departmental level. Planning undertaken by individual departments to mitigate the impact of an influenza pandemic on their operations (see paragraph 3.13).

Local level. Pandemic influenza plans developed by local authorities, local resilience forums and health organisations. Based on a survey of local resilience forums carried out by the then Ministry of Housing, Communities, & Local Government, as of February 2020, all forums had an overarching influenza pandemic plan, 28 had worked with organisations across forum boundaries on planning and exercising, and 13 had carried out exercises to test their plans since 2017.

Responsibilities for preparing for an influenza pandemic are set out in Figure 7).

3.3 Preparations for high-consequence emerging diseases involved horizon scanning, carried out by Public Health England, to identify and gather information about outbreaks and incidents of new and emerging infectious diseases, occurring anywhere in the world. Additionally, the Human Animal Infections and Risk Surveillance Group, a cross-government multi-agency group, carries out horizon scanning and risk assessment for emerging animal infections that may be transmitted to humans (as was the case for severe acute respiratory syndrome (SARS) and Middle East respiratory syndrome (MERS)) and pose a threat to UK public health. Public Health England established a protocol (FF100) for assessing the first few hundred cases of a novel infection in the UK and their close contacts to gain an early understanding of key clinical, epidemiological and virological characteristics of the disease, inform the development of policy and guidance on managing cases, and help reduce the spread of infection.

3.4 As part of preparations for high-consequence emerging diseases, NHS England and NHS Improvement established procedures for identifying, isolating and treating infected individuals, and Public Health England maintained a contact tracing capability. Because the government had anticipated a high-fatality virus with severe symptoms, it set up specialist centres to isolate and treat patients who would become severely ill. As of December 2019, there were six treatment centres for high-consequence infectious diseases in England. By October 2020, one more centre had been set up. In the early days of the COVID-19 pandemic, when COVID-19 was classified as a high-consequence infectious disease, infected people were taken to these centres. As the disease became better understood, the government revised this classification and ceased to use high-consequence infectious disease protocols in the response to COVID-19.36 Public Health England also issued guidance for healthcare professionals on specific high-consequence infectious diseases.

Preparations for a pandemic like COVID-19

3.5 The 2017 National Risk Register identified a broad risk of new and emerging infectious diseases, which included high-consequence infectious diseases like Ebola and MERS, alongside diseases which, like COVID-19, have an overall lower fatality rate. However, the Cabinet Office told us that scientists considered a disease like COVID-19, which has an overall low fatality rate and widespread community transmission, less likely than a pandemic influenza or a high-consequence infectious disease. Published strategies were therefore not tailored to a disease with the specific characteristics of COVID-19. The Department of Health & Social Care told us that the government’s preparations can be adapted to help identify, contain and mitigate novel viral risks.

3.6 In 2016, as the Ebola emergency was subsiding, the Science and Technology Committee recommended that the government worked with leading experts to publish an emerging infectious disease strategy setting out:

the priority threats the UK wished to address;

how much funding would be directed to each threat;

how action would be delivered, how outcomes would be evaluated; and

how coordination across funding streams would be achieved.37

In its response, the government did not commit to publishing such a strategy, but noted that every edition of the National Risk Register had identified emerging infectious diseases as a significant risk to the UK; stated that the Ross Fund, which brought together the then Department of Health and the then Department for International Development’s spending on infectious diseases, would include governance and oversight mechanisms to ensure coordination of expenditure; and noted that NHS England and Public Health England were pursuing a programme to prepare for and respond to high-consequence infectious diseases.38

3.7 Prior to the pandemic, the government did not explicitly agree what level of risk it was willing to accept for an event like COVID-19. We saw evidence of departments setting their risk appetite in response to the pandemic, in particular setting a higher-than-usual risk tolerance to respond to a rapidly evolving situation. We did not see evidence that, prior to the pandemic, the government had agreed its overall risk appetite in relation to a pandemic by explicitly accepting a specific level of residual risk. The Cabinet Office told us that, as the pandemic started, the government lowered the threshold for the health and societal impacts of the pandemic that it deemed acceptable. Government officials also told us that, while some specific functions, such as security and fraud functions, have a sense of the government’s appetite for the risks that fall within their remit, a shared understanding of risk tolerance for many cross-government issues is still being developed.

3.8 Some of the government’s preparations could be used, sometimes with adaptation, to respond to COVID-19 and these formed the basis for the government’s initial health response to the pandemic. For example, Public Health England:

adapted the existing FF100 surveillance protocol to monitor the first few hundred cases of COVID-19, and told us that it had adapted routine surveillance systems designed for influenza to COVID-19;

issued COVID-19 infection prevention and control guidance for healthcare providers on 10 January 2020, and guidance for social or community care and residential settings and (in collaboration with the Department for Education) schools in February 2020, building on existing guidance on infection control and managing outbreaks in schools and care homes. The guidance was issued before the first care home outbreak was reported on 10 March 2020.

used its existing contact tracing capability to carry out test and trace activities for COVID-19 until 16 March 2020, when the comprehensive tracing of all community cases ceased in the face of rising infection levels;39 and

told us that it relied on pandemic influenza plans in its initial response to COVID19, before developing a concept of operations tailored to the new virus.

3.9 Because the government had prepared for a respiratory virus on a large scale, it could use its stockpile of personal protective equipment (PPE) in response to COVID-19, but neither the stockpile nor the usual PPE-buying and distribution arrangements could cope with the extraordinary demand created by the pandemic.40 The government also obtained advice from specialist ethical and scientific advisory committees set up to support the response to emergencies and designed from previous learning on emergency preparedness.

Preparations outside of the health sector

3.10 Following a pandemic simulation exercise in 2016, Exercise Cygnus, the government established the Pandemic Flu Readiness Board to undertake a cross-government programme of work to improve pandemic preparedness. This resulted in:

the draft Pandemic Influenza Bill. This was the basis for the Coronavirus Act which set the legislative measures required to support local and national response activities;

work led by the Civil Contingencies Secretariat (CCS) to ensure that key sectors of the national infrastructure could cope with high levels of employee absences;

a draft planning framework for strengthening capabilities to manage excess deaths;

a plan for increasing capacity in adult social and community care; and

a draft strategy for government’s communications during a pandemic.

3.11 Prior to COVID-19, the government had issued a range of guidance documents in preparation for, and response to, an influenza pandemic beyond the health sector, covering businesses, employers and employees, coroners, agencies involved in the justice system, faith communities, higher and further education institutions, and the hospitality industry. Some of this guidance was updated shortly before the onset of COVID-19, whereas other guidance documents had not been updated for over a decade.

3.12 The 2019 National Security Risk Assessment (the Assessment) recognised that an influenza-type pandemic could have extensive non-health impacts, including on communications, energy supplies, education, finance, food supplies and transport services, and this was one of the driving risks behind a quarter of the planning assumptions in the document. Departments did not have detailed plans in place for the following:

Identifying and supporting a large population advised to shield. The testing of plans and policies for the identification and shielding of clinically extremely vulnerable people were not objectives of the simulation exercises that the government had carried out to test its preparedness for an influenza pandemic. At the start of the pandemic, there was no mechanism to allow a fast ‘sweep’ across all patients to identify, in real time, those who fell within a defined clinical category.41

Employment support schemes. The 2011 UK influenza pandemic preparedness strategy estimated that an influenza pandemic resulting in half the workforce being absent from work for 1.5 weeks each would have led to a loss of £28 billion. The 2019 Assessment estimated that 20% of people would be off work during the peak weeks of an influenza pandemic, causing a significant impact on business continuity, and noted that the economic impact was likely to be felt for years. HM Treasury and HM Revenue & Customs told us that they drew on economic contingency planning designed for financial rescues, developed following the financial crisis of 2007–2009; draft policy work on wage subsidy schemes; and lessons learned from other countries, such as Germany.42

Financial support to local authorities, such as mechanisms for compensating authorities for a fall in sales, fees and charges income. The then Ministry of Housing, Communities & Local Government told us it had stress-tested its response to an economic shock as part of its contingency planning. However, the economic impact of the pandemic exceeded the economic shock assumed for this stress-testing.43

Managing mass disruption to schooling on the scale caused by the pandemic.44 The Department for Education’s emergency response function was designed to manage disruptions due to localised events such as floods. The government’s strategy and operational guidance on an influenza pandemic, published in 2011 and 2012, respectively, stated that “it is unlikely that widespread school closures will be required except in a very high impact pandemic”.45 However, a 2014 review of the impact of school closures on an influenza pandemic, carried out by the then Department of Health, concluded that it was reasonable to consider school closures as a component of a mitigation strategy during an influenza pandemic. The review noted that “policy may need to be responsive to the particular features of any future pandemic virus” and school closures may negatively affect disadvantaged families more than non-disadvantaged families.46 

3.13 Departments’ pandemic plans and business continuity plans did not set out all the processes and responses required to maintain government operations during the pandemic. In February and March 2020, a cross-government working group carried out a review of 76 pandemic business continuity arrangements across government, commissioned by the Civil Contingencies Committee (known as ‘COBR’). The review found that most plans (82%) were unable to meet the demands of any actual incident (Figure 8). Plans lacked:

evidence of testing through a simulation exercise in the previous year (82%);

pre-scripted, signed-off messages or communication protocols, such as for dealing with fear, anxiety and misinformation (50%);

mitigating actions for the loss of suppliers or delivery partners (41%);

procedures for detecting, reporting and monitoring staff absences (37%); and

a detailed incident management response structure (32%).

These findings are in line with the results of our review of 15 pandemic and business continuity plans, and other government documents.

3.14 The CCS told us that the government does not maintain plans to respond to every emergency in the Assessment. Instead, it aims to strike a balance between detailed planning in some areas and responsiveness in other areas, the marginal cost of implementing mitigations, and the risk of perverse incentives (for instance, whether a detailed government plan for a given emergency might discourage businesses from undertaking the necessary preparations, such as taking up insurance). It also told us that it carries out horizon scanning, focuses on the most serious risks or those where it is worried that a department’s planning is deficient in some way or needs to be improved, sets expectations for how departments should prepare for emergencies, and offers a programme to develop departments’ capability to address risks. Its remit does not involve carrying out formal assurance work on departments’ plans for responding to emergencies. However, the CCS stated that it brings pressure to bear on departments if it thinks that risks are not dealt with properly.

3.15 The then Ministry of Housing, Communities & Local Government told us that, while its liaison officers support and challenge local resilience forums, their role is obtaining reassurance rather than formal assurance over local resilience forums’ readiness for emergencies. Some government organisations told us that, as of November 2020, they were relying on self-assurance from individual business units on their emergency plans rather than carrying out assurance work on those plans.

Resources for risk management

3.16 The Government Internal Audit Agency has highlighted variable capability, capacity, and engagement in relation to risk management across the departments and their teams. Government officials stated that preparations for EU Exit enhanced the crisis capabilities of some departments and that the government was able to apply lessons from the central coordination of an area of risk (EU Exit) to the pandemic response. For instance, government officials told us that:

cross-government governance, risk management and reporting structures used, such as the Covid-19 Strategy and Operations Cabinet committees, largely mirrored pre-existing structures that were enhanced by EU Exit preparations;

training and exercises carried out as part of EU Exit work provided many of those involved in the COVID-19 response with a good understanding of crisis operations; and

some departments activated operation centres which they had initially set up as part of EU Exit preparations.

3.17 Preparations for EU Exit took up a significant amount of time and resources across the civil service. Government officials told us that this limited the time and resources that were devoted to preparing for other emergencies. For example:

some work areas of the Pandemic Flu Readiness Board and the Pandemic Influenza Preparedness Programme Board, including scheduling a pandemic influenza exercise in 2019-20, were paused or postponed to free up resources for EU Exit work;

as of March 2019, the CCS had allocated 56 of its 94 full-time equivalent staff to preparing for potential disruptions from a no-deal exit, limiting the resources that it could devote to planning for other emergencies;

the National Exercise Programme was significantly scaled down from 2017 onward as resources were directed to the operational and policy response to the Grenfell Tower fire and to EU Exit work; and

national guidance to local resilience forums on excess deaths for an influenza pandemic was published in 2012. Public Health England told us that work to update this guidance started in 2018 but was overtaken by EU Exit preparations.47

Learning from incidents and exercises

3.18 To inform continuous improvement, the government aims to learn from actual incidents and simulation exercises. Although major incidents on the scale of COVID-19 are rare, all incidents provide opportunities for real-world validation of plans. Public Health England reported that it had:

responded to over 10,000 disease outbreaks and emergencies in England in 2018-19, including measles, meningitis, listeria and monkeypox;

responded to 29 major emergencies between 2016 and the onset of COVID-19; and

participated in 282 exercises from 2003 to 2020, of which at least 68 related to infectious diseases. Figure 9 provides some examples.

3.19 Changes that have resulted from incidents and exercises include the following:

Learning from the 2009-2010 H1N1 influenza pandemic that informed the UK influenza pandemic preparedness strategy, published in 2011, and the operational guidance on health and social care influenza pandemic preparedness and response, published in 2012;

Programmes undertaken by NHS England and Public Health England to improve their ability to respond to high-consequence infectious diseases following the 2014–2016 Ebola outbreak. This led to the establishment of the network of high-consequence infectious disease treatment centres; changes in procedures, such as the publication of monthly reports on GOV.UK; and numerous changes to Public Health England’s National Incident & Emergency Response Plan;

The 2017 revision of pandemic plans, which was informed by learning from Exercise Winter Willow;

Following Exercise Valverde, a voluntary agreement that was developed between Global Health Security Initiative members to facilitate the rapid sharing of non-influenza biological materials, such as virus and serum samples during a public health emergency;48 and

Following Exercise Cygnus, the government’s setting up of the cross-government Pandemic Flu Readiness Board, co-chaired by the CCS and the Department of Health & Social Care, to undertake a programme of work to improve pandemic preparedness (see paragraph 3.10).

3.20 Some learning points identified from incidents and exercises did not translate into improvements in the government’s preparedness, because the same issues emerged in the response to the COVID-19 pandemic. For example, following Exercise Winter Willow in 2007, the government noted that there was a clear need for organisations to better define their linkages to others and to ensure that their business continuity plans were better coordinated with those of their partner organisations.49 At the outset of the COVID-19 pandemic, many departmental business continuity plans did not set out mitigating actions for the loss of suppliers or delivery partners. Following Exercise Cygnus in 2016, the government noted that consideration should be given to the ability of staff to work from home, particularly when staff needed access to secure computer systems.50 At the outset of the COVID-19 pandemic, many departmental business continuity plans did not include arrangements for extensive home working.

International experience

3.21 Many other countries prepared for an influenza pandemic but did not have plans in place to respond to a non-influenza pandemic (Figure 10). A 2016 report of the UN High-level Panel on Global Response to Health Crises noted that the world’s preparedness and capacity to respond to a future pandemic were “woefully insufficient”.51 The first report of the Global Preparedness Monitoring Board, published in 2019, found that, globally, many of the recommendations from previous high-level panels and commissions following the 2009 H1N1 influenza pandemic and the 2014–2016 Ebola outbreak were poorly implemented or not implemented at all. The report noted that “the great majority of national health systems would be unable to handle a large influx of patients infected with a respiratory pathogen capable of easy transmissibility and high mortality.”52

34 Civil Contingencies Secretariat, The Lead Government Department and its role: Guidance and Best Practice, March 2004.

35 While the government first convened the Independent Scientific Pandemic Insights Group on Behaviours after the onset of COVID-19, it did convene a similar group, the Scientific Pandemic Influenza group on Behaviour and Communications, in 2009, to advise on issues pertaining to the H1N1 pandemic, and it received expert advice on behavioural issues relating to the Ebola outbreak in West Africa in 2014.

36 The government classified COVID-19 as a high-consequence infectious disease in January 2020. It revised this classification in March 2020 on the grounds that COVID-19 had an overall low mortality rate and could be detected rapidly. Pandemic influenza may have an overall low case-fatality rate (as did the H1N1 pandemic) but, unlike a coronavirus such as the virus causing COVID-19, it can be treated with antivirals.

37 House of Commons Science and Technology Committee, Science in emergencies: UK lessons from Ebola, Second Report of Session 2015-16, HC 469, January 2016.

38 Department of Health, Government response to the House of Commons Science and Technology Committee Second Report of Session 2015-16: Science in Emergencies: UK lessons from Ebola, Cm 9236, April 2016.

39 Comptroller and Auditor General, The government’s approach to test and trace in England – interim report, Session 2019–2021, HC 1070, National Audit Office, December 2020.

40 Comptroller and Auditor General, The supply of personal protective equipment (PPE) during the COVID-19 pandemic, Session 2019–2021, HC 961, National Audit Office, November 2020.

41 Comptroller and Auditor General, Protecting and supporting the clinically extremely vulnerable during lockdown, Session 2019–2021, HC 1131, National Audit Office, February 2021.

42 Comptroller and Auditor General, Implementing employment support schemes in response to the COVID-19 pandemic, Session 2019–2021, HC 862, National Audit Office, October 2020.

43 Comptroller and Auditor General, Local government finance in the pandemic, Session 2019–2021, HC 1240, National Audit Office, March 2021.

44 Comptroller and Auditor General, Support for children’s education during the early stages of the COVID-19 pandemic, Session 2019–2021, HC 1243, National Audit Office, March 2021.

45 NHS and Department of Health, Health and Social Care Influenza Pandemic Preparedness and Response, April 2012; see also Department of Health, UK Influenza Pandemic Preparedness Strategy 2011, November 2011.

46 Department of Health, Impact of School Closures on an Influenza Pandemic: Scientific Evidence Base Review, May 2014.

47 Following the onset of COVID-19, the government published updated guidance for managing excess deaths during a pandemic and the specific requirements of the COVID-19 pandemic in March 2020.

48 The Global Health Security Initiative is an informal, international partnership that aims to strengthen public health preparedness and response globally to threats of chemical, biological, and radio-nuclear terrorism, as well as pandemic influenza.

49 Department of Health, Exercise Winter Willow: Lessons Identified, August 2007.

50 Public Health England, Exercise Cygnus Report: Tier One Command Post Exercise – Pandemic Influenza, July 2017.

51 United Nations, Protecting humanity from future health crises: Report of the high-level panel on the global response to health crises, February 2016.

52 Global Preparedness Monitoring Board, A world at risk: Annual report on global preparedness for health emergencies, September 2019.

Part Four

Recent developments

4.1 This part covers recent developments in:

risk management; and

national resilience.

Risk management

4.2 In May 2021, the Government Internal Audit Agency reviewed its findings on risk management across government drawing on its work over the past few years. It noted that risk practices across government have improved over time and that organisations are placing increased importance on the growing contribution and influence of their risk function. The review found several areas for further improvement, mainly due to variability across departments in several areas, including:

senior leadership support and promotion of risk management, including at board and executive levels;

capacity and engagement in relation to risk management across the departments and their teams;

approaches and frequency in horizon scanning and communication of emerging risks from arm’s-length bodies; and

although all departments had a risk management framework in place, some departments could strengthen processes, including escalation and oversight, by closer alignment to the Orange Book.

4.3 Since 2019, the government has undertaken several actions to strengthen risk management within the public sector, such as:

establishing the Heads of Risk network to champion risk management standards and share good practice;

consolidating risks from single departmental plans and departmental risk registers for consideration by the Civil Service Board;

publishing a revised version of the Orange Book on risk management, guidance on risk appetite and risk reporting, and a skills and capability framework for public sector risk management professionals;

setting out requirements for the identification and management of principal risks within spending reviews and the development of outcome delivery plans; and

mandating enhanced risk disclosures in 2020-21 public sector Annual Report and Accounts.

4.4 The Office for Budget Responsibility’s recent fiscal risks report highlights lessons for understanding and responding to potentially catastrophic fiscal risks.53 It notes that:

the government must trade off making significant investments in the prevention of specific potential risks with preserving enough fiscal space to respond to those risks that it did not anticipate or could not prevent and, in the absence of perfect foresight, fiscal space may be its single most valuable risk management tool;

the difficulty in anticipating the precise timing and nature of the ‘next crisis’ puts a premium on governments engaging in horizon scanning and investing in generic risk management systems and structures; and

while it is difficult to predict when catastrophic risks will materialise, it is possible to anticipate their broad effects if they do.

Emergency preparedness

4.5 In December 2019, the Civil Contingencies Secretariat (CCS) issued a set of national resilience standards, including a pandemic preparedness standard, to help local resilience forums and their constituent organisations self-assure their capabilities and level of readiness, and to set out good practice. The standards were developed in collaboration with local responders, the then Ministry of Housing, Communities and Local Government, other government departments and agencies, the devolved administrations, the Emergency Planning College, the Joint Emergency Services Interoperability Programme team and professional institutions. The CCS told us that it is developing a set of standards to help departments identify what civil contingencies capabilities they should have and self-assure their readiness level, and to serve as a guide for external assurance over departments’ capabilities.

4.6 Following the review of pandemic business continuity arrangements by a cross-government working group (paragraph 3.13), the group offered surgeries to organisations to help them improve their business continuity arrangements. The group reported that, following the surgeries, four departments submitted their revised plans for re-scoring and received a higher score. The group also issued a supplier assurance checklist and a lessons learned report to members of the cross-government business continuity forum to help improve arrangements across government organisations.

4.7 In December 2020, the Pandemic Influenza Preparedness Programme Board confirmed that pandemic preparedness planning should cover non-influenza pandemic threats, both respiratory and non-respiratory. This aligned with a subsequent May 2021 recommendation from a review commissioned by the Cabinet Office.54 The Department of Health & Social Care told us that a wider range of scenarios are now being developed for future pandemic planning, including respiratory (influenza and non-influenza), contact and vector-borne scenarios. This work is also being reported to the new Pandemic Diseases Capabilities Board, co-chaired by the CCS and the Department of Health & Social Care, to support pandemic planning across government.

4.8 The organisation of health protection activity within government has been reformed. In October 2021, Public Health England’s health protection duties were transferred to the UK Health Security Agency, a newly established executive agency of the Department of Health & Social Care. It is responsible for planning, preventing and responding to external health threats, including ensuring that the UK can respond quickly and at greater scale to pandemics. The UK Health Security Agency is intended to provide a permanent standing capacity to plan, prevent and respond to external threats to health. It brings together Public Health England, NHS Test and Trace and the analytical capability of the Joint Biosecurity Centre. At the same time, the Office for Health Improvement and Disparities was established within the Department of Health & Social Care to take forward the prevention agenda across government to reduce health disparities, many of which have been exacerbated by the COVID-19 pandemic, and to improve the public’s health.

4.9 The government intends to set up a catastrophic emergencies programme to focus on about 10 risks that may give rise to whole-system emergencies. The Cabinet Office told us that the programme will seek to address the challenges posed by the breadth of impact of catastrophic emergencies and to provide support for departments’ planning for catastrophic risks. It will also seek to promote discussion of the government’s risk appetite and ministerial awareness of risks.

National resilience

4.10 In March 2021, the government published its integrated review of security, defence, development and foreign policy.55 The review highlighted a need for greater national resilience to threats and hazards in the physical and digital worlds, both at home and overseas. It set out several priority actions including:

establishing a whole-of-society approach to resilience, bringing together the government, critical national infrastructure operators, the wider private sector, civil society and the public;

developing more capabilities (people, skills and equipment) that can be used across a range of scenarios, including through contingency planning and regular exercises; and

strengthening the UK’s and global preparedness for future pandemics.

4.11 The integrated review committed to developing a new National Resilience Strategy to outline its vision for UK resilience in 2030 and objectives for achieving it. In July 2021, the government began consultation on this strategy, seeking views across six themes: risk and resilience; responsibilities and accountability; partnerships; community; investment; and resilience in an interconnected world. The consultation noted the need:

to build a more effective system for handling complex risks. This would include assessing the whole range of potential impacts ahead of time and ensuring that the government has enough oversight structures in place to assure the adequacy of the planning in place;

to improve decision-making through data and analysis. The government will launch a new National Situation Centre to enhance situational awareness of all risks, ranging from civil contingencies to national security;

for greater targeted investment upfront in preparing for risks; and

for government and society to have more open and honest conversations about the risks they are willing to accept, the risks they choose to mitigate, the risk trade-offs and the risks they should seek to prevent above all else.56

53 Office for Budget Responsibility, Fiscal risks report, CP 453, July 2021.

54 Boardman review of government procurement during the COVID-19 pandemic, Cabinet Office, May 2021.

55 HM Government, Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy, March 2021.

56 Cabinet Office, The National Resilience Strategy: A Call for Evidence, July 2021.

Appendix One

Our audit approach

1 The scale and nature of the COVID-19 pandemic and the government’s response are without precedent in recent history. The pandemic has tested the government’s plans to deal with unforeseen events and shocks and demonstrated the threats that exist to UK citizens. Like all governments across the world, the UK government will need to learn lessons from its preparations for and handling of this type of threat.

2 This report sets out the facts on:

the government’s approach to risk management and emergency planning;

what actions the government took to identify a risk of a pandemic like COVID-19;

what actions the government took to prepare for a pandemic of this nature; and

recent developments.

3 The report sets out central government’s risk analysis, planning and mitigation strategies prior to the arrival of the COVID-19 pandemic, with the aim of drawing out wider learning for the government’s overall risk management approach. It does not cover local-level risk planning by, for example, NHS trusts, NHS foundation trusts and local authorities; wider aspects of resilience planning, such as health service capacity, or the robustness of supply chains; and top-level disaster response procedures, such as convening the Civil Contingencies Committee, known as ‘COBR’. It also does not cover the government’s response to COVID-19, including how effective the government’s preparations proved to be once they were enacted in the pandemic response, or how prepared the government was for subsequent waves of the pandemic.

Methods

4 Our fieldwork took place between July 2020 and August 2021, with a hiatus between January and June 2021. In conducting this work, we drew on a variety of evidence sources.

5 We interviewed key individuals from the Civil Contingencies Secretariat, the Department of Health & Social Care, the Department of Work & Pensions, Public Health England, the Ministry of Defence, the then Ministry of Housing, Communities & Local Government, the government’s Heads of Risk Network and the Government Internal Audit Agency, as well as academics working on emergency planning. The work was designed to understand the government’s:

approach to risk management and emergency planning;

identification of risks related to a pandemic; and

preparations for a pandemic or new and emerging infectious disease.

6 We reviewed the top-level risk registers of 17 departments and seven arm’s-length bodies, and the business continuity or pandemic plans of 15 bodies prior to the pandemic. The work was designed to understand the extent to which government bodies identified a pandemic or infectious disease as one of the principal risks they faced and what plans they had in place to mitigate its impact on their operations.

7 We reviewed the risk registers of the following departments, dated between July and December 2019: the Cabinet Office; the Department for Business, Energy & Industrial Strategy; the Department for Digital, Culture, Media & Sport; the Department for Education; the Department for Environment, Food & Rural Affairs; the then Department for International Development; the Department for International Trade; the Department for Transport; the Department for Work & Pensions; the Department of Health & Social Care; the then Foreign & Commonwealth Office; HM Revenue and Customs; HM Treasury; the Home Office; the then Ministry of Housing, Communities & Local Government; and the Ministry of Justice. While we did not review the risk register of the Ministry of Defence, we discussed its contents with the department’s officials.

8 We reviewed the risk registers, dated between July 2019 and January 2020, of seven arm’s-length bodies responsible for responding to emergencies: the Animal and Plant Health Agency; the Environment Agency; the Food Standards Agency; the Health and Safety Executive; the Maritime and Coastguard Agency; NHS England and NHS Improvement; and Public Health England.

9 We reviewed the business continuity or pandemic plans of 10 departments and five arm’s-length bodies, dated between April 2017 and February 2020: the Department for Digital, Culture, Media & Sport; the Department for Environment, Food & Rural Affairs; the then Department for International Development; the Department for International Trade; the Department for Work & Pensions; the then Foreign & Commonwealth Office; HM Revenue and Customs; HM Treasury; the Home Office; the then Ministry of Housing, Communities & Local Government; the Maritime and Coastguard Agency, the Met Office, NHS England and NHS Improvement, the Nuclear Decommissioning Authority and the UK Atomic Energy Authority. Eleven of these plans were organisation-wide and four related to specific sites or business areas. The aim of this work was to corroborate the conclusions of the review of business continuity plans that a cross-government group carried out in February and March 2020 (paragraph 3.13).

10 We also reviewed the community risk registers of all 38 local resilience forums in England. The work was designed to understand the types of risk that featured in these registers. Community risk registers were dated between December 2015 and November 2019.

11 We reviewed other relevant documents. These included: Cabinet Office documentation on risk assessment and risk management, including the 2019 National Security Risk Assessment; Department of Health & Social Care, NHS England and NHS Improvement, and Public Health England documentation on preparations for an influenza pandemic and emerging infectious diseases; and Government Internal Audit Agency reports on risk management.

12 We contacted several other supreme audit institutions to ask about their countries’ risk identification and planning documents for a pandemic. We also reviewed supreme audit institutions’ responses to a questionnaire, administered by the Czech Republic Supreme Audit Office in 2020, on plans for responding to a pandemic. We held meetings with Audit Scotland, Audit Wales and the Northern Ireland Audit Office to gain an insight into the preparedness of the devolved administrations for the COVID-19 pandemic.

Design and Production by NAO Communications Team
DP Ref: 009200-001