The costs of a major local authority IT project - Tech Refresh - in one of the poorest areas in London have doubled and millions of pounds have been paid to consultants without the council putting in place proper controls or records.
But Haringey Council refuses to reveal who its partners were. "We haven't confirmed who our partners were on this project and don't intend to," it said.
It has also emerged that the Audit Commission, the public sector watchdog, found that Haringey approved 140 change requests costing £7.1m without exercising appropriate control, did not always adhere to good practices specified in Prince2 methodology, and had barriers to open and honest communication.
There was also inadequate reporting on the IT project to all members of the council.
Disclosures about the lack of controls at Haringey come against a background of claims by the Treasury's Office of Government Commerce that the public sector is getting better at IT projects and learning the lessons of past failure. The OGC has resisted calls from MPs for better parliamentary scrutiny of public sector IT projects.
The lapses and overspending on Haringey's Tech Refresh scheme also show how a project that was designed to help the council meet government targets on delivering services electronically can go badly wrong.
Last year the council reported that the project had overspent by only £500,000. But the Audit Commission, which has investigated the project, found that some council members knew in August 2004 that the project had already overspent by £3.7m.
By summer 2005 the costs of the project had risen from £9m to £24.6m and although suppliers have absorbed £5.5m, the council's bill is £19.1m, more than double the budget set for the project in 2003. And external auditors have warned that costs may rise further.
The commission said it was unable to ascertain from the documents available "how budgetary control was exercised".
Costs increased significantly through the use of external consultants. Although the project estimates allowed for 338 days worth of change management consultancy over the life of the scheme, more than half of these days were used up in April 2005 alone.
Earlier this month, in a statement to opposition councillors, the ruling Labour group at Haringey praised the Tech Refresh project, saying it was 95% complete and "on the way to develop real benefits for the people of Haringey".
The statement added that the scope of the project increased as new IT needs became apparent. "For instance the original project budgeted for 2,500 PCs to be refreshed whereas in fact over 4,700 have been refreshed."
But the Audit Commission identified two of the main causes of the overspend as change management consultancy and change requests.
The council's project leader was able to authorise a significant amount of change requests "before any form of scrutiny was applied," said the Audit Commission.
Some change requests were approved or submitted retrospectively - one was for £32,000 for an information stall at the council's 2004 Summer Event for the local community.
So poor was the reporting to the council that highlight reports to the project board did not contain any financial information.
Computer Weekly has learned that Haringey Council appointed Deloitte and Touche, one of the world's largest professional services firms, to be involved with design work for the project, which the company had helped to specify and cost.
Deloitte and Touche's auditing arm is also the council's main internal auditor, an appointment made with Haringey Council's full approval.
Northgate Information Solutions, the authority's infrastructure supplier, was contracted to help with implementation.
Councillor Neil Williams, leader of the Lib-Dem opposition at Haringey, said: "The scale of the mismanagement of this project is astonishing. There needs to be a full review. However, I am sceptical that this will happen."
The Audit Commission's report did not mention the work of Deloitte and Touche's auditing arm as the main internal auditor for the council while Deloitte and Touche was also a major partner on Tech Refresh.
Neither the council nor Deloitte and Touche were willing to comment on Deloitte's work for the council.
Haringey Council said: "Tech Refresh is a major programme upgrading IT infrastructure across the council, which is already significantly improving services and beginning to save money.
"Extra costs were reported in May 2005 and at that point programme management was brought in-house."
"The council asked the district auditor (not our internal auditor) to examine the project in detail, and this report was accepted by the council in January.
"An action plan is underway to address the auditor's recommendations, and current spending on the programme is in line with budgets."
It added that the extra costs have not resulted in any cuts to services and will not mean an increase in council tax. "But projects should not overspend like this, which is why we are taking action."
When asked about Deloitte and Touche, Haringey Council said: "We haven't confirmed who our partners were on this project and don't intend to. There is an issue of commercial confidentiality."
The council said its external auditors, the Audit Commission, audited the Tech Refresh project, not its internal auditors. The Audit Commission gave the council's general practices relating to financial management a clean bill of health, the council said.
"Additionally there [are] guidelines which companies have to follow when bidding for multiple contracts. There has never been any suggestion that these were breached by us or our contractual partners."
There are no statutory or regulatory requirements which prevent internal auditors such as Deloitte and Touche taking on non-audit IT work.
An Official at the Institute of Chartered Accountants in England & Wales said that internal auditors, when doing non-audit work, will sometimes follow ethical guidance issued by the Auditing Practices Board for external auditors.
Computer Weekly has published a summary of some of the guidance of the Auditing Practices Board on page 20.
Northgate made no comment. A spokesman for Deloitte and Touche said: "Deloitte and Touche is subject to client confidentiality conditions and cannot comment."
Audit Commission's key findings
"We concluded that there was limited evidence of:
- sufficiently senior project sponsorship;
- adequate staffing resources being allocated to deliver the project;
- application of appropriate budgetary control mechanisms, including provision of suitable financial information;
- timely, transparent and accurate reporting of the project slippages and overspends; and
- clear audit trails."
Source: Audit Commission, Review of Project Management, Haringey London Borough Council, Audit
Read more on IT risk management
Poor use of Haringey Council's electronic recording system played a part in the mismanagement of the Baby P case, according to a review published today (1...