Investigation into the performance of UK Security Vetting

Cabinet Office

Session 2022-23
18 January 2023
HC 1023

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2021, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £874 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Investigation into the performance of UK Security Vetting

Cabinet Office

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 16 January 2023

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

12 January 2023

© National Audit Office 2023

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

This report is a follow-up to our 2018 investigation looking at the national security vetting service. We undertook this follow-up work due to concerns being raised about progress with the Vetting Transformation programme and also because of suggestions from government departments that vetting clearances were not being processed quickly enough.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

012280 01/23 NAO

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Evan Davies, Charlotte Facto, Tom Tyson and Stephanie Woodrow, under the direction of Lee Summerfield.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Key facts

What this investigation is about

United Kingdom Security Vetting

1 The Cabinet Office is responsible for national security vetting. United Kingdom Security Vetting (UKSV) is a business area within the Cabinet Office that delivers the service. Security vetting provides assurance on individuals working with government assets and classified information. UKSV provides vetting services for all government departments and a wide range of other public bodies, as well as some private sector industries such as the aviation industry, whose staff need clearance to work in airports.

2 There are several different types of vetting levels with the most common being Counter Terrorist Checks (CTC), Security Checks (SC) and Developed Vetting (DV). Since 2018-19, UKSV has received an average of 164,700 CTC and SC clearances and 17,900 DV clearances per year. DV clearance is the most complex and allows individuals access to more sensitive government information and assets than CTC or SC clearance. From 1 January 2022, UKSV also started processing Accreditation Checks, a new legislative requirement for those working in the airline industry. Just over 100,000 of these had been processed by the end of September 2022.

3 UKSV was established in January 2017, following a merger of previous vetting services by the then Foreign & Commonwealth Office and the Ministry of Defence (MoD). Following the merger, UKSV was part of the MoD, although security vetting policy was set by the Cabinet Office. We covered this merger as part of our September 2018 investigation into national security vetting which examined the reasons for poor performance levels across UKSV and the subsequent recovery plan.1

4 In April 2020 UKSV moved from MoD into the Cabinet Office, where it is part of the Government Security Group. As a result, the Cabinet Office has responsibility for all elements of security vetting, from operational delivery to policy. Some elements of the transition from MoD have not been fully completed and UKSV is still managing legacy elements of the transition. This includes reducing its reliance on MoD’s IT infrastructure as well as opening its own enquiry centre as service enquiries were being routed through MoD.

5 The performance of UKSV deteriorated significantly in 2021-22 as demand for vetting increased with the easing of COVID-19 restrictions, particularly in the turnaround times for DV clearances. In January 2022, UKSV launched a recovery plan, called the delivery stabilisation plan. This is a short-term plan seeking to reduce backlogs and improve turnaround times for all clearance levels by focusing on streamlining processes and working more efficiently.

6 There have been multiple attempts both to improve performance and to modernise the vetting system since UKSV’s inception in 2017. Its latest modernisation plan, launched in 2020, and known as the Vetting Transformation programme, aims to address the underlying systemic problems within vetting through a radical overhaul involving new systems, processes and policies. UKSV has been implementing the Vetting Transformation programme alongside continuing to transition from MoD to the Cabinet Office and the stabilisation plan.

7 This investigation follows on from our investigation into national security vetting in 2018, looking specifically at the role of UKSV. It examines:

UKSV’s performance levels;

the causes of poor performance and what progress UKSV is making in addressing them; and

how UKSV is seeking to modernise and reform security vetting.

8 This investigation does not look at the effectiveness of security vetting in acting as a deterrent and in preventing malign individuals getting access to sensitive government information and assets. It also does not seek to assess any operational impact on government departments that may be related to the timeliness of clearances.

1 Comptroller and Auditor General, Investigation into national security vetting, session 2017-19, HC 1500, National Audit Office, September 2018.

Summary

Key findings

Performance levels

9 In every month since August 2021, United Kingdom Security Vetting (UKSV) has fallen short of its targets for routine Counter Terrorist Checks and Security Checks (CTC/SC) and Developed Vetting (DV) clearances, with performance falling to its worst ever level since it was created in 2017. UKSV’s two main performance indicators for routine clearances are to complete 85% of CTC/SC clearances in 25 days, and to complete 85% of DV clearances within 95 days. UKSV’s processing of CTC/SC clearances last met the target in July 2021 and fell to a low of 15% of clearances cleared in 25 days in September 2022. For DV clearances, UKSV last met its target in May 2021 and performance fell to just 7% of clearances completed within 95 days in April 2022. Customers can request UKSV to prioritise up to 3% of their clearance requests for faster turnaround times. UKSV has been consistently closer to reaching its target level for these priority clearances. Since it reduced the target slightly in April 2022, it is now meeting it consistently (paragraphs 1.4, 1.5 and 1.9 and Figures 2 and 5).

10 Nearly one-third of DV clearances in 2022-23 have taken more than 180 days to process, almost double UKSV’s 95-day target, and backlogs exist. For customers this means that nearly one-third (30%) of DV clearances will take more than half a year to process – delays mean individuals cannot fully take up their new positions. By comparison, during 2019-20 less than 4% of DV cases took more than 180 days. For SC clearances, the checks are quicker and less onerous, but there is also a shift towards longer processing times, with 72% of clearances taking longer than 25 days in 2022-23. Alongside longer processing times, backlogs have developed for both DV and CTC/SC clearances. For DV clearances, the total number of clearances in hand peaked at 14,600 in June 2022 and for CTC/SC total clearances in hand were 27,900 in November 2022. We calculated that this is 9,900 more DV and 16,600 more CTC/SC clearances than UKSV might expect to hold if it was meeting its targets (paragraphs 1.6 and 1.7 and Figures 3 and 4).

11 UKSV is also failing to meet its target for providing aftercare checks on DV clearances. These checks take place between the initial clearance and a full renewal that should take place seven years later, with the aim of capturing any changes in circumstances that might impact on the clearance. These checks can either be scheduled or unscheduled if a need arises. UKSV aims to complete 85% of scheduled aftercare checks within 95 days but has failed to meet that target since the start of 2018-19. It has also failed to meet its target for unscheduled checks, although the volume of these is far lower than for scheduled checks (paragraph 1.9 and Figure 6).

12 UKSV’s performance has been affected by a range of issues:

Customer demand rose sharply in 2021-22 as the employment market recovered from the COVID-19 pandemic, with DV requests increasing by 57% and CTC/SC requests increasing by 60%. For both DV and CTC/SC requests, actual demand was higher than customer forecasts in 11 out of 12 months (paragraph 2.4 and Figure 7).

UKSV is under-resourced to meet customer demand forecasts. At the start of 2021-22 it had a shortfall of 316 (32%) compared with the 985 it estimated it needed, and despite additional recruitment in that year was still 237 short by the end of 2021-22. Additionally, 10% more of UKSV’s staff are currently allocated to non-core delivery tasks compared with 2019-20 (paragraph 2.9 and Figure 9).

The IT system UKSV uses to process cases is old and unstable, with regular outages that slow down and stop the clearance process for extended periods (paragraph 2.13).

How UKSV is attempting to recover performance

13 Since July 2022 UKSV has sought to defer demand by extending some DV clearances that are due for renewal, to allow it to prioritise clearing a backlog in new DV clearances. Prioritising new DV clearances has been a key component of the delivery stabilisation plan that UKSV launched in 2022 to attempt to recover performance. Existing DV clearances are normally reviewed after seven years to ensure that individuals’ circumstances have not materially changed and that the initial clearance remains valid. In April 2022, the Government Security Steering Group directed UKSV to extend all DV renewals. UKSV therefore extended them by 12 months from 1 July 2022, apart from high-risk exceptions. This has helped UKSV to reduce its DV backlog from 14,600 in June 2022 to 11,700 in November 2022, with 1,200 of this reduction due to extending renewals. Both UKSV and its customers recognise that this deferral decision carries security risks particularly as it is not the first time that renewals have been extended (paragraphs 2.2, and 2.5 to 2.7).

14 Prioritising new DV clearances rather than renewals has extended the clearance times for those renewals already in the system. When choosing to prioritise new clearance requests UKSV recognised that it was making a trade-off with performance on other clearances it was processing. It introduced a new 200-day target for renewals in April 2022 rather than the previous 95-day target for these cases. The focus on new DV clearances has seen the average clearance time for those cases fall from 177 days in April 2022 to 98 days in November 2022 against a target of 95 days. However, for renewals, the average clearance time has increased from 190 days in April 2022 to 255 days in November 2022, exceeding the revised 200-day target (paragraphs 2.6 and 2.7 and Figure 8).

15 UKSV is balancing its recovery efforts with responding to other external events such as the war in Ukraine. In addition to the 3% of clearances that customers can request to be prioritised, UKSV has been separately fast-tracking any clearance request that is necessary as part of the UK’s response to the war in Ukraine. It also chose to offer prioritisation to all CTC clearances for civil aviation security to help ease difficulties that were being experienced across UK airports earlier in 2022. To date in 2022-23, UKSV has prioritised 13.2% of all CTC/SC clearances and 4.9% of all DV clearances rather than the 3% commitment it offers customers (paragraph 2.8).

16 UKSV has increased its staff resources in 2022-23 to try to recover performance but is required to make efficiencies by March 2023. By November 2022, UKSV had increased its full-time equivalent (FTE) headcount number to 877 but was still 268 FTEs (23%) short of the 1,145 FTEs it assessed it needed, based on customer demand forecasts for 2022-23. The Cabinet Office approved a headcount of 832 FTEs for UKSV to the end of March 2023, plus an additional 163 contingent labour and temporary staff from other government departments, giving a total of 995. UKSV anticipates that the remaining shortfall of 160 FTEs will be met through efficiencies and automation of processes coming out of its delivery stabilisation plan (paragraph 2.10).

17 UKSV’s stabilisation plan has helped it increase the number of DV clearances it is processing in 2022-23. Alongside prioritising clearances and short-term increases in capacity, the stabilisation plan has focused on increasing productivity, and automating and enhancing existing IT systems. These measures enabled UKSV to complete 49% more DV clearances in 2022-23 than in the same period in 2021-22 as it works through the 57% increase in demand from 2021-22. UKSV is recording increasing numbers of DV cancellations in 2022-23 as individuals drop out of the DV clearance process as they secure alternative jobs. UKSV also completed 12% more CTC/SC clearances in 2022-23 than in the same period in 2021-22 (paragraphs 2.2, 2.4 and 2.11, and Figures 10 and 11).

UKSV’s ambition to reform vetting

18 UKSV has had multiple attempts to modernise the vetting system and does not currently expect to complete its reforms until 2024-25 at the earliest. Efforts to modernise vetting policy and processes were included within UKSV’s Vetting Reform programme launched in 2019. It rebranded this as the Vetting Transformation programme in 2020 and promised to deliver a full programme of reform, including modernising the IT infrastructure, by March 2023. Two and a half years later, UKSV has yet to get Cabinet Office approval for the full business case for the Vetting Transformation programme and progress has slowed as UKSV chose to prioritise its recovery plan and the legacy transition from the Ministry of Defence (MoD). It now expects to complete the transformation programme by 2024-25 at the earliest (paragraphs 3.3, 3.8, 3.10 and 3.12, and Figures 13 and 14).

19 UKSV has been unable to secure approval for its Vetting Transformation programme business case because the Cabinet Office is concerned about the deliverability of the programme and its achievability. Following its initial funding approval for modernising the IT system, the Cabinet Office’s Approvals Board has subsequently only granted the minimum amount required to extend IT developer contracts for between three and six months on several occasions, and in December 2022 it approved £9 million for UKSV to deliver the new Level 1 clearances. Three recent reviews of the programme also raised serious concerns around its deliverability, flagging concerns across multiple key areas of programme management, such as clarity of the end-state vision and target operating model, UKSV’s governance structure and financial constraints (paragraphs 3.7, 3.10 to 3.12 and Figures 14 and 15).2

20 UKSV’s customers are funding the transformation programme and are frustrated with the lack of progress. Customers fund both the existing service and transformation costs in proportion to their use of the service. Government policy dictates that UKSV is the provider of vetting services. Some customers complain that although they therefore have to use UKSV and to contribute to the transformation programme, they have no say in how the funding is used and do not understand what the end vision of the programme is. UKSV forecasts it will underspend by £6.5 million on the programme in 2022-23 owing to delays to the business case, progress on the plan and delays in resourcing. UKSV has redeployed a net £1.5 million elsewhere across its business and is therefore currently forecasting it will be refunding customers around £5 million in 2022-23 (paragraphs 1.2, 2.10, 3.14 and 3.15).

21 The Cabinet Office’s initial efforts to modernise the IT infrastructure ran almost 50% over budget and ended in failure in 2021, with £2.5 million written off. The Cabinet Office had planned to automate many of its processes and replace outdated IT systems through its £19 million Future Vetting System (FVS) programme, expected to complete in February 2020. Failures in project management meant that it failed to realise that it had gone £9 million over budget without securing the necessary financial approvals. The Cabinet Office wrote off £2.5 million in its 2021-22 accounts relating to the FVS programme and UKSV is still using the old National Security Vetting System (NSVS) that it wanted to abandon in 2018 because it lacks capacity, is slow and requires many manual workarounds (paragraphs 2.13, 3.7 and 3.8).

22 UKSV created the IT platform to enable Accreditation Checks to be introduced in January 2022. Accreditation Checks (AC) were a new legislative requirement for those working in the aviation industry. UKSV does not conduct the checks but its role was to create the IT platform to enable the checks to take place and it was initially supposed to have this in place by January 2021. It met a revised go-live target of January 2022 and, by the end of September 2022, 100,000 ACs had been completed (paragraph 3.9).

23 Insufficient resources in specialist areas continue to be a major obstacle to reform. Overhauling the digital architecture is central to reforming vetting but UKSV has consistently struggled to recruit in this area. It still has a heavy reliance on IT contractors despite deciding to move to a largely in-house approach after the failure of the previous attempt to reform the IT system. Its current resource modelling shows it has a shortfall of 68 FTEs for digital roles. It is also under-resourced in commercial, project management and human resourcing. UKSV feels that the terms and conditions it can offer are the main inhibitors to recruitment in these specialisms (paragraph 3.14).

Concluding remarks

24 National security vetting is of vital importance to the effective functioning of government. If individuals’ clearances are not processed quickly then government departments risk being unable to progress work relating to national security. Once individuals are given clearance it is important that this is reviewed and renewed regularly to ensure that there have not been material changes in their circumstances that might increase the risks associated with them having access to sensitive government information.

25 The Cabinet Office took on responsibility for the delivery of national security vetting in 2020 following a sustained period of poor performance. UKSV’s record in delivering timely clearances continues to be poor and efforts to recover performance over the past year have included prioritising certain types of clearance at the expense of others. Meanwhile, longer-term efforts to transform the way security vetting is delivered have made little progress, with a clearly set out implementation plan for transforming security vetting still to be agreed.

Recommendations

26 The Cabinet Office should:

a recognise the importance of modernising the national security vetting process and work quickly to design an implementation plan with key milestones in place;

b ensure that governance structures are appropriate to enable effective challenge and scrutiny of UKSV without becoming an impediment to progressing work on national security vetting;

c create a set of performance metrics that measures whether clearances are being processed in a timely and accurate way that meets customer needs and avoids perverse incentives;

d recognise, and be clear across government, that given UKSV’s agreed resources, prioritising certain types of clearances will have knock-on impacts, both on routine clearance and on delivering long-term transformation; and

e ensure that there is sufficient resilience within UKSV to react to new events that might drive increased demand for security vetting.

2 These reviews were conducted by Cabinet Office Portfolio Office, Government Consulting Hub and Government Internal Audit Agency.

Part One

United Kingdom Security Vetting’s performance

1.1 This part of the report sets out United Kingdom Security Vetting’s (UKSV’s) performance against targets for security vetting applications and the trends in processing times and backlogs since 2017. We look at the factors affecting performance in Part Two as well as considering what UKSV is doing to try to improve performance.

UKSV

1.2 UKSV, which sits within the Cabinet Office, is the main government provider of national security vetting. Security vetting provides assurance around individuals working with government assets and classified information. UKSV provides vetting services for customers including all government departments, a wide range of other public bodies and some private sector industries such as the aviation industry, whose staff need clearance to work in airports. UKSV’s funding costs are covered by its customers on a proportional basis depending on use of the service. Over the past two years, regular service costs have been £43 million on average. The Ministry of Defence (MoD) is UKSV’s largest customer by a considerable margin, making up 56% of all clearance requests. The Home Office and HM Revenue & Customs are the second and third biggest customers respectively by clearance requests.

1.3 There are different levels of vetting, each of which require different processes (Figure 1). Developed Vetting (DV) clearance is the most complex and allows individuals access to more sensitive government information and assets than Counter Terrorist Check (CTC) or Security Check (SC) clearance. Since 2018-19, UKSV has received an average of 164,700 CTC and SC clearances and 17,900 DV clearances per year. From 1 January 2022, UKSV also started processing Accreditation Checks (AC), which are now a legislative requirement for those working in the airline industry.

Performance against key targets and other metrics

1.4 UKSV has two targets covering its performance on the vast majority of CTC/SC and DV clearances it processes, which it measures itself against. These targets aim to ensure that it provides timely turnaround of clearance requests from customers:

CTC/SC clearances – 85% of routine clearances to be completed within 25 days.

DV clearances – 85% of routine clearances to be completed within 95 days.

These measures do not show the number of vetting applications waiting to be processed, or how many days each case takes, although UKSV does collect and monitor these data. UKSV is reviewing these performance indicators as it wants a more rounded set of metrics, making more use of the data that it collects on the number of clearances it holds and length of time to clear them.

1.5 Since April 2017, UKSV has met its target for CTC/SC clearances in 32 out of 68 months. For DV clearances it has met its target in 20 out of 68 months (Figure 2). UKSV has failed to hit the target for either type of clearance since July 2021 and performance in 2022-23 fell to the lowest it has ever been since it started measuring these targets in 2017 for both CTC/SC (15% in September 2022) and DV (7% in April 2022) clearances.

1.6 An increasing proportion of clearances are taking significantly longer than the target time to clear. Nearly one-third (30%) of DV clearances processed in 2022-23 took more than 180 days to process, almost double the 95-day target (Figure 3). For customers this means that nearly one-third of DV clearances will take more than half a year to process, delaying when people can take up positions fully. During 2019-20 less than 4% of DV cases took more than 180 days. For SC clearances, 72% of clearances are now taking longer than the 25-day target to process.

1.7 UKSV has also seen backlogs build up for clearances over the past two years. Clearances in hand for DV cases have doubled since the start of 2021-22, with a peak of 14,600 DV clearances in June 2022 (Figure 4). We calculated that this is 9,900 more clearances than UKSV might expect to hold if it was processing cases within its 95-day target. For CTC/SC, clearances in hand have also increased over the past two years, standing at a high of 27,900 in November 2022, which is 16,600 more than it might expect to hold if it was processing cases within its 25-day target.

Priority cases

1.8 UKSV allows all its customers to label up to 3% of their clearances as priority cases. These are cases where the customer has decided it needs an accelerated clearance process and as a result UKSV sets itself more stretching targets for these clearances. Before April 2022, it aimed to clear 95% of priority CTC/SC clearances within 10 days and 30 days for DV priority clearances. UKSV’s performance against these targets is more consistent than it is for routine cases, but it has still only met these more challenging targets for CTC/SC and DV clearances in 30 and 23 out of 60 months respectively between April 2017 and March 2022 (Figure 5). UKSV reduced its target to 90% in April 2022 and has met the target since then.

Aftercare

1.9 UKSV also measures its performance on providing aftercare checks for DV clearances. These checks take place between the initial clearance and a full renewal that should take place seven years later, with the aim of capturing any changes in circumstances that might impact on the clearance. These checks can either be scheduled or unscheduled if a need arises. UKSV aims to complete 85% of scheduled aftercare checks within 95 days but has failed to meet that target once since the start of 2018-19 (Figure 6). It has also failed to meet its target for unscheduled checks although the volume of these is far lower than for scheduled checks.3

Customer perspective on performance

1.10 Customers have representation on various UKSV governance groups and regularly use these to air their frustrations with the performance of UKSV as it can directly impact on their ability to place individuals into important jobs with national security implications. Customers do not generally mention concerns over the quality of decisions being made. Their focus is instead on the pace at which those decisions are reached, although they have noted improvements in the service towards the end of 2022.

1.11 One step that ministerial departments can take is for ministers to write to UKSV about issues. Ministers have written to UKSV to complain about the service they are getting. Ministers have also written to complain about individual cases. Of 62 ministerial correspondences received about vetting between October 2020 and October 2022, 33 were regarding delayed clearances or the impact of delays to employment opportunities and recruitment for national security roles. Over the same period, six complaints by the public regarding delayed clearances have been addressed directly to Parliament.

3 UKSV only completed 257 unscheduled aftercare checks in the 12 months before December 2022 compared with 1,782 scheduled checks. Its target for unscheduled checks is to complete 85% within 30 days.

Part Two

Factors affecting United Kingdom Security Vetting’s performance and its actions to recover

2.1 This part of the report sets out the factors contributing to United Kingdom Security Vetting’s (UKSV’s) decline in performance since July 2021, such as:

rising demand (paragraphs 2.4 and 2.5);

under-resourcing (paragraphs 2.9 and 2.10); and

an out-dated, unreliable IT system (paragraphs 2.13 and 2.14).

It also describes the steps UKSV has taken to try to mitigate these issues, primarily through its delivery stabilisation plan, and the outcomes (paragraph 2.11).

2.2 UKSV introduced the delivery stabilisation plan in January 2022. It is viewed as a short-term tactical solution rather than a longer-term transformation, which it is pursuing separately (see Part Three). The plan aims to improve clearance times and reduce backlogs by March 2023 by focusing on:

prioritisation of certain clearances;

increasing short-term capacity across UKSV;

increasing productivity across the organisation; and

automating and enhancing existing IT systems.

In September 2022, the Cabinet Office Approvals Board agreed a business case for £5 million funding to implement technology projects until March 2023.

Changing demand for security vetting services

2.3 UKSV relies on demand forecasts from all its customers ahead of each financial year to enable it to plan for the resources it will need.4 In 2020-21, customers over-forecast how many clearances they were likely to need, unaware of the coming COVID-19 pandemic, which caused a drop in demand for clearances. Actual demand only exceeded forecast demand for Developed Vetting (DV) clearances in March 2020-21. For Counter Terrorist Check and Security Check (CTC/SC) clearances, actual demand fell below forecast in every month (Figure 7). This lower-than-expected demand meant UKSV was able to largely meet its performance targets in 2020-21 (see Figure 2 in Part One).

2.4 Conversely, during 2021-22 customers under-forecast their demand as the employment market changed as COVID-19 restrictions eased. For both DV and CTC/SC requests, actual demand was higher than forecast in 11 out of 12 months. Overall, in 2021-22, demand for DV clearances increased by 57% and demand for CTC/SC clearances increased by 60%. UKSV’s customers generally accept that they need to produce more accurate forecasts if UKSV performance levels are to improve. UKSV has also reminded customers that missed vetting appointments and incomplete application forms add delay to the time taken to process clearance requests.

2.5 DV demand was also affected in 2021-22 by the Cabinet Office Government Security Board (GSB) decision not to extend all DV renewals again. Each DV clearance is normally reviewed after seven years to ensure that individuals’ circumstances have not materially changed and that the initial clearance remains valid. In 2018 the GSB first took the decision to implement a 12-month extension to some renewals to help UKSV recover performance at that time.5 It repeated the decision in 2019, and then again in April 2020 to help cope with the impact of the COVID-19 pandemic on operations. In 2021-22, however, all DV renewals that had previously been extended came back up for renewal and were not extended again, meaning that a backlog of cases needed processing.6 UKSV at that time did not collect data on how many DV clearances were new requests and how many were renewals so it was not aware of the full impact that decision would have.

2.6 In April 2022, to defer demand, the Government Security Steering Group, a governance group with representation from departmental accounting officers, directed UKSV to again extend renewals to focus on reducing the backlog of new DV clearances that had developed. UKSV therefore extended them by 12 months from 1 July 2022, apart from high-risk exceptions. Since June 2022, the DV backlog has fallen from 14,600 to 11,700 in November 2022, with 1,200 of this 2,900 reduction resulting from renewal extensions. Every DV renewal extension that is granted will at some point in the future have to be fully worked to approve the renewal. Average clearance times for new cases remain above the 95-day target level but have fallen from 177 days in April 2022 to 98 days in November 2022 (Figure 8).

2.7 In choosing to prioritise new clearance requests, UKSV recognised that it was making a trade-off with performance on DV renewals that were already in the system. It therefore introduced a new 200-day target for DV renewals in April 2022 rather than the old 95-day target that existed for all types of DV clearances. Since then, clearance times for DV renewals have increased further, from 190 days in April 2022 to 255 days in November 2022. Both UKSV and its customers acknowledge that another extension of renewals carries security risks that are uncomfortable. In mitigation, UKSV is aiming to improve the use of Annual Security Appraisal Forms (ASAF), a form which DV-cleared individuals and their line managers are required to complete. Between December 2020 and December 2022, UKSV recorded 51,374 completed ASAFs by departments compared with an estimated 105,500 (49%) that should have been completed. UKSV told us it does not grant renewals without evidence that either these checks have been completed, or there is satisfactory evidence from individuals’ supervisors through testimony or interviews. The lack of timely aftercare checks (see paragraph 1.9) also increases the risk that individuals are going prolonged periods of time without having their DV clearance reassessed.

2.8 UKSV is prioritising an increasing number of clearances. All UKSV customers can label up to 3% of their requests as priority clearances, for which UKSV aims to offer a faster turnaround time than normal clearances. Outside of this priority lane, however, UKSV has been separately fast-tracking clearance requests required as part of the UK’s response to the war in Ukraine. It also chose to offer prioritisation to all clearances for civil aviation security to help ease difficulties that were being experienced across UK airports earlier in 2022. To date in 2022-23, UKSV has prioritised 13.2% of all CTC/SC clearances and 4.9% of all DV clearances rather than the 3% commitment it offers customers. Prioritising certain types of clearances has knock-on effects for other types of clearances. Focusing on new DV clearances has seen increases in processing times for DV renewals. Likewise, there was a reduction in performance against the CTC/SC clearance time target in the first half of 2022 as new DV cases were prioritised (see Figure 2 in Part One).

Under-resourcing

2.9 UKSV has been under-resourced to meet customer demand forecasts since its inception in 2017.7 By April 2021, UKSV had 669 full-time equivalent (FTE) staff against the 985 FTE it expected to need to meet forecast demand during 2021-22 (Figure 9), a shortfall of 316 FTE (32%). Additionally, 10% more of UKSV’s staff are currently allocated to non-core delivery tasks compared with 2019-20. UKSV was affected by a Cabinet Office recruitment freeze, although it was granted a partial exemption for vetting delivery roles in December 2021. Despite seeking to recruit throughout the financial year, by March 2022 UKSV still had a 237 shortfall against its requirement for that year. UKSV feels that its recruitment for some core delivery roles is hampered by the terms and conditions it can offer within the Cabinet Office compared with some other large operational departments.

2.10 Based on customer demand forecasts for 2022-23, UKSV estimated it would require 1,145 staff, 160 higher than the year before. By November 2022, UKSV had increased its FTE headcount number to 877 (23% short of estimated need), in part through adding contingent labour and temporary staff from other government departments. The Cabinet Office, as part of wider plans for efficiencies across the civil service, expects UKSV to maintain its headcount number at no higher than 832 FTEs at March 2023, 313 (27%) FTEs short of the demand forecast figure of 1,145; but it has authorised an additional 163 contingent labour and temporary staff from other government departments, bringing the total to 995. The resources required for UKSV have been discussed with the Cabinet Office resources team throughout 2022-23.8 UKSV anticipates that the remaining shortfall of 160 FTEs will be met through efficiencies and automation of processes coming out of its delivery stabilisation plan.

2.11 UKSV’s stabilisation plan has also aimed to increase productivity through a range of other measures, including:

emphasising the use of an incentivisation scheme rewarding staff for clearing additional cases;

trialling new ways of working to streamline processes; and

enhanced use of management information to monitor performance.

Taken together, these initiatives have contributed to increases in the number of clearances that UKSV is processing as it seeks to work through the increased demand since the start of 2021-22. Completions of DV clearances have increased by 49% in 2022-23 compared with the same period in 2021-22 but there are also increasing numbers of cancellations as individuals drop out of the process having secured alternative jobs (Figure 10). Requests for DV clearances fell after May 2022 as a result of the decision to again extend DV renewals (see paragraph 2.6). UKSV is also completing 12% more CTC/SC clearances per month in 2022-23 than it was in the same period in 2021-22 (Figure 11). Turnaround times against its main performance indicators are also improving but for both CTC/SC and DV are still well short of target levels (see Figure 2 in Part One).

2.12 UKSV is also dealing with a disengaged workforce. It scored 46% on the overall Employment Engagement Index in its Civil Service People Survey results for 2022, down three percentage points from 49% in 2021 and 19 percentage points below the civil service average (Figure 12). Only 24% of UKSV staff who responded were motivated by UKSV to achieve its objectives and 19% said that they felt a strong personal attachment to the organisation. All question scores were lower than the civil service benchmarks.

Unreliable IT system

2.13 UKSV’s IT system, the National Security Vetting System (NSVS), provides an end-to-end service for security vetting applications and decisions. Built in 2014, NSVS is unreliable and UKSV has been seeking to replace it since 2018. The system lacks capacity, is slow and requires many manual workarounds. These factors, together with regular outages, slow down the whole vetting process and user satisfaction is extremely low.

2.14 The original contract to manage, host and support NSVS was due to expire in 2020 but has been extended three times and will now run until at least 2024 at a cost of £10.2 million between March 2022 and February 2024. The latest extension, granted in December 2021, included both ongoing running costs, and business-critical enhancements to stabilise ageing infrastructure and supporting costs. As part of the £5 million spending approval that UKSV got for its stabilisation plan, £2.2 million of this was to enhance the security of NSVS and increase the stability of the platform.

4 Forecasts are provided in October for the following financial year.

5 See our 2018 report, Investigation into national security vetting, paragraph 3.19.

6 Any DV clearance that was coming up for its first renewal during the 2021-22 period was extended.

7 We reported on UKSV’s staffing against its target workforce in our 2018 report, Investigation into national security vetting, see Figure 1 on page 17 of that report.

8 During 2022-23, Cabinet Office and UKSV went through two business planning rounds agreeing FTE numbers of 1,078 and then 878. This was then amended again to 811 FTE before being agreed at 832 with the additional 163 temporary staff.

Part Three

Security vetting reform

3.1 This part of the report sets out United Kingdom Security Vetting’s (UKSV’s) intentions for the overall reform of security vetting through the Vetting Transformation programme (formerly the Vetting Reform programme), and progress made to date.

3.2 While UKSV seeks to recover performance through its latest stabilisation plan, it also recognises the need to reform the system and address the root causes of continued under-performance.

Vetting Reform programme

3.3 Following a period of poor performance, in January 2019, the Cabinet Office created the Vetting Reform programme (VRP), which had four key aims:

Moving UKSV from the Ministry of Defence (MoD) to Cabinet Office (paragraphs 3.4 to 3.6)

Modernising UKSV’s IT infrastructure (paragraph 3.7)

Stabilising performance levels

Transforming the security vetting process (paragraphs 3.8 to 3.15)

We examined UKSV’s previous attempts to stabilise performance in our 2018 investigation into national security vetting and we look at UKSV’s current stabilisation plan in Part Two.9

UKSV’s move from MoD to Cabinet Office

3.4 UKSV was first established at the start of 2017 following a merger of previous vetting services by the then Foreign & Commonwealth Office and MoD. It sat within MoD at that point, but security vetting policy was set by the Cabinet Office. The decision to move it into the Cabinet Office was then made after discussions between the then chief executive of the civil service and MoD, who agreed that it made sense to align operational delivery and policy for security vetting within the Cabinet Office. The Cabinet Office has not been able to provide any evidence to show that a formal options appraisal was conducted at that time.

3.5 In April 2020, UKSV transitioned from MoD to sit within the Government Security Group within the Cabinet Office. The Cabinet Office considered at that time making UKSV an executive agency which would have made it independently accountable with a chief executive in charge, but that option was not taken forward.10 Despite this, the Cabinet Office appointed a chief executive to run UKSV, who has been in post since January 2021 but only with delegated authority for spending decisions up to £250,000. The UKSV chief executive reports to the government chief security officer (GCSO), the head of the Government Security Group. The GCSO has delegated authority on spending decisions up to a maximum of £500,000. The Cabinet Office’s finance director can approve up to £1 million, the Cabinet Office Approvals Board (COAB) up to £15 million and HM Treasury approval is required for spending of more than £15 million.

3.6 The transition from MoD to the Cabinet Office went ahead as scheduled in April 2020 but UKSV still has some legacy dependencies on MoD including IT systems and kit, the enquiry centre and several locations. UKSV expects to complete these remaining elements of the move in 2022-23 but completing these in parallel with attempts to recover performance and progress transformation is proving challenging given its limited resources.

Modernising UKSV’s IT infrastructure

3.7 As part of the VRP, the Cabinet Office planned to automate many of UKSV’s processes and replace outdated IT systems through the Future Vetting System (FVS) programme. FVS was originally planned for completion in February 2020 with a budget of £19 million but failures in project management meant that the Cabinet Office ran £9 million overbudget without securing the necessary financial approvals. The Cabinet Office wrote off £2.5 million in its 2021-22 accounts relating to the FVS programme. UKSV accepts that FVS failed to take account of the business and policy needs of security vetting. After several re-plans – postponing the delivery date to summer 2020, then autumn 2020 and finally summer 2021 – the programme was eventually subsumed within the new Vetting Transformation programme in June 2021. At the point it was folded into the transformation programme, the proposed whole-life costs had doubled to £40.2 million, and the projected delivery date had moved to 2022-23.

Vetting Transformation programme

3.8 In 2020, UKSV rebranded the VRP as the Vetting Transformation programme. The Vetting Transformation programme is broader than updating the technology platforms and aims to fundamentally transform how vetting is delivered, with new vetting levels, a more continuous, quicker, and portable clearance process, and an improved user experience (Figure 13). One area of the programme it has already progressed is increasing the amount of centralised decision-making where UKSV takes the whole decision on clearance rather than allowing departments to make the final decision. UKSV told us that implementing this did, however, reduce resources available for normal clearance work.

3.9 Alongside its work to update the current vetting levels, UKSV has delivered the IT infrastructure for Accreditation Checks (AC). This was a new legislative requirement for those working in the aviation industry that was initially supposed to be in place by January 2021 as part of the FVS programme. When the FVS programme failed, UKSV reset the target implementation date for January 2022 and met that deadline despite aviation industry concerns that this was a rushed revised timetable. UKSV does not conduct the checks for ACs but acts as a portal for processing them. By the end of September 100,000 of these checks had been completed, and it is expected that more than 200,000 checks a year will be supported.

Costs of Vetting Transformation programme

3.10 Since the IT modernisation project moved under the umbrella of the Vetting Transformation programme in June 2021, UKSV has repeatedly sought spending approval from COAB with limited success. On each occasion, COAB has granted the minimum amount required to extend IT contracts for between three and six months, while requesting further clarification on various aspects of the business case (Figure 14). UKSV is aware that the short-term nature of spend approvals received both restricts its negotiating power to obtain best value for money and creates a risk that suppliers may be reluctant to contract with them.

3.11 COAB’s reluctance to approve spending reflects its concerns over the clarity of the end vision for the programme, how UKSV intends to achieve it, or the tangible benefits reform will bring. Three reviews of the Vetting Transformation programme in 2022 have also raised serious concerns around the deliverability of the programme, including clarity around the end state vision and target operating model, UKSV’s governance structure and financial constraints (Figure 15).11 The three reports made 121 recommendations covering all areas of programme management. UKSV has logged all these recommendations and is seeking to implement them, with 44% closed off by December 2022.

3.12 In 2022, UKSV chose to prioritise its stabilisation plan over the Vetting Transformation programme. In September 2022, UKSV was still self-assessing the delivery confidence of the programme as Red due to:

resource constraints in the Digital, Data and Technology team and the Programme team;

only having partial spend approval for financial year 2022-23; and

consequential impacts on delivery timeframes, business readiness planning and benefits realisation.

UKSV was due to again seek full business case approval for the programme in December 2022. However, it recognised given this assessment that this was not feasible. As a result it only sought to gain approval to progress work on the new Level 1 clearances (broadly equivalent to Counter Terrorist Check and Security Check), which it has been privately testing with a major customer since autumn 2022, and which COAB provisionally approved. That testing is helping UKSV to refine its new security questionnaire and to test the automation of some checks needed for Level 1 clearance. UKSV told us it is aiming to submit a business case for Level 2 and Level 3 clearances in July 2023 and its 2022–25 strategy aims to complete vetting transformation by 2025.

Recruitment challenges

3.13 Overhauling the IT system is central to vetting reform, but UKSV has consistently struggled to recruit in this area. In November 2021, UKSV alerted Cabinet Office to the difficulties UKSV was having, citing uncompetitive salaries as a factor which resulted in the organisation only managing to fill five out of 44 roles despite multiple costly, labour-intensive campaigns. In December 2021, UKSV was granted a partial exemption for digital roles from the Cabinet Office recruitment freeze. Despite this exemption, UKSV’s resource modelling still showed a shortfall of 68 full-time equivalents (FTE) for digital roles against a total requirement of 108 in September 2022. As a result, UKSV still relies heavily on contractors, despite the decision to move to a largely in-house approach after the failure of the previous attempt to reform its IT. UKSV’s commercial and people teams also have shortfalls, running at 69% and 60% respectively.

Customer viewpoint

3.14 UKSV’s customers are funding the transformation programme based on their proportional use of UKSV’s services and are frustrated with the lack of progress. Confidence in UKSV was damaged by the failure of the FVS project which was also funded by customers with some complaining that they do not have visibility over how that money was spent.

3.15 Customers are represented on the Government Security Board, the Vetting Board and the Vetting Modernisation Portfolio Board. Customers have complained that they have no option but to use UKSV for their vetting and to contribute to the transformation programme, but they have no say in how the funding is used and do not understand what the end vision of the programme is. The disparity in use of UKSV’s services by different customers has also led some smaller users to complain that they are being side-lined as UKSV seeks to assuage the concerns of its biggest customers. UKSV forecasts it will underspend by £6.5 million on the programme in 2022-23 due to delays to the business case, delays to progress on the plan and delays in resourcing. UKSV has redeployed a net total of £1.5 million elsewhere across its business, meaning that it is currently forecasting it will be refunding customers around £5 million in 2022-23.

9 The National Audit Office reported on this in Part Three of Comptroller and Auditor General, Investigation into national security vetting, Session 2017–2019, HC 1500, National Audit Office, September 2018.

10 The classification of an Executive Agency can be seen on page 12 of Classification of Public Bodies: Guidance for Departments, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/519571/Classification-of-Public_Bodies-Guidance-for-Departments.pdf

11 Reviews by Cabinet Office Portfolio Office, Government Internal Audit and Assurance, and a joint review by the Government Consulting Hub, Central Digital & Data Office and Government Digital Service.

Appendix One

Our investigative approach

Scope

1 We investigated how the Cabinet Office’s United Kingdom Security Vetting (UKSV) has performed against its key performance indicators (KPIs) and other key metrics. We examined issues underlying UKSV’s performance and what it is doing to try to recover performance, and how UKSV is seeking to modernise and reform security vetting. We did not look at the effectiveness of security vetting in acting as a deterrent and in preventing malign individuals getting access to sensitive government information and assets.

2 We conducted our fieldwork between September and November 2022. Our investigation concentrated on the role of UKSV rather than any other bodies that may play a role in the whole vetting process.

Methods

3 In examining these issues, we drew on a variety of evidence sources.

Interviews

4 We carried out 12 fieldwork meetings with UKSV and Cabinet Office officials. The main topics covered were:

trends in performance and the Delivery Stabilisation plan

staffing and recruitment

IT infrastructure and the Future Vetting System programme

ambitions for reform and the Vetting Transformation programme

UKSV’s governance and accountability arrangements

the transition of UKSV from the Ministry of Defence to the Cabinet Office; and

the support provided by the Cabinet Office to UKSV, including the role of the Cabinet Office Approvals Board in approving spend for the Vetting Transformation programme.

5 We interviewed officials representing some of UKSV’s biggest customers to get a customer perspective on the challenges facing UKSV and its performance. Customers interviewed were: the Ministry of Defence, the Foreign, Commonwealth & Development Office, the Department for Transport and the Civil Aviation Authority.

6 We interviewed the authors of three internal reviews of UKSV to discuss their findings and recommendations.

7 In October 2022, we also held a day of face-to-face meetings with UKSV officials in York. The purpose of the visit was to meet the senior leadership team and speak to front-line staff including vetting officers and IT contractors. In December 2022, we visited UKSV’s Model Office in Glasgow.

Document review

8 We reviewed key documents to provide contextual information on UKSV’s ambitions for reform, its internal and external governance arrangements, its major programmes, and to review its actions to mitigate the risk of backlogs emerging and manage the backlogs that developed.

9 The main types of document we reviewed were:

a selection of relevant ministerial submissions, correspondence between ministers and senior UKSV officials, and UKSV executive team papers, to understand actions and decisions, including the decision to move UKSV from the Ministry of Defence to the Cabinet Office;

management information data, including on resourcing, complaints and appeals, volumes of applications received and processed, holding levels, processing times and performance against KPIs, to understand why backlogs developed and triangulate verbal explanations;

business cases and related submissions for the Future Vetting System, Delivery Stabilisation plan, and Vetting Transformation programme to map out funding requests and approvals;

board minutes for the Future Vetting System Board, the Vetting Reform Programme Board, the Vetting Transformation Board, and the Vetting Board, to identify issues raised by stakeholders in relation to each of the programmes;

internal reviews of the Vetting Transformation programme and recommendations tracker for evidence of actions being taken in response to issues identified; and

UKSV’s customer newsletters, for evidence of how UKSV keeps its customers informed of performance and progress with updating the IT infrastructure and the vetting process as a whole.

Quantitative analysis

10 We used quantitative analysis to understand the potential backlogs that UKSV possesses for Counter Terrorist Check and Security Check (CTC/SC) and Developed Vetting (DV) clearances. UKSV does not possess its own definition of what it regards as a backlog. We therefore calculated how many DV clearance cases UKSV might expect to receive over a 95-day period (95 days being its target processing time) based on the average number of clearance requests received over the past four complete financial years. This came to a figure of 4,700, meaning that we assumed that if clearances being processed were more than this there was a backlog. The same calculation was used for CTC/SC clearances, this time using the 25-day period, which produced a figure of 11,300 as the threshold for a backlog.

11 We also examined UKSV performance against its KPIs. When triangulated to interview and documentary evidence, this also supported some findings on causes of the backlog and drivers of the subsequent recovery plan.

12 Most of the data we present are drawn from UKSV’s internal management information, meaning they are not automatically subject to the same quality checks as official statistics or audited accounts. We have not audited the underlying systems producing these data.

13 Other datasets included:

UKSV’s staff numbers (full-time equivalent), broken down by business area;

the number of complaints by source category, for example direct customer complaints, or complaints via ministers;

the staff engagement survey; and

financial data from business cases.

Design and Production by NAO Communications Team
DP Ref: 012280-001