The Audit Commission report into hard-pressed London Borough of Haringey provides an object lesson in how not to run an IT modernisation project.
Between Hackney in the south and Tottenham in the north is one of the poorest areas in the UK. It has crack houses in abundance, unemployment that is double the UK rate and thousands of homeless families call on the council for shelter.
But it is not all bad news in the London Borough of Haringey, at least not for the council's IT suppliers. For the authority has proved to be a beneficent sponsor of computer projects, some of which have involved some of the world's largest technology companies.
And one project at least, Technical Refresh, has the added benefit of arming IT suppliers - and users - with invaluable information on How Not to Manage an IT Project.
By the standards of computer disasters in central government, the £24.6m spent on Haringey Council's Tech Refresh scheme, as it is called, is unlikely to put it in the first tier of mismanaged projects.
But the £24.6m is more than twice the scheme's original budget of £9m; and rarely since the notorious "RISP" project was launched by Wessex Regional Health Authority in the 1990s has a public authority spent so freely with suppliers and consultants, without having adequate controls.
When the council watchdog the Audit Commission was eventually called in to investigate the Tech Refresh scheme, it found that suppliers and consultants were being paid millions of pounds without adequate controls or records. "The project leader who has left the council had day-to-day control of budgets," said the Audit Commission. "From the documents available to us, it is unclear how budgetary control was exercised."
Many of the mistakes made on Tech Refresh are the same as those made regularly by Whitehall departments: an independent evaluation of the project by consultants was interpreted as an endorsement of the project's proposals whereas it was only an assessment of the technical aspects; changes were made without independent challenge, and the approach to openness, accountability and clear reporting led the Audit Commission to say, "Escalation of problems and issues appears to have been taken in an informal way or not at all. It is not clear whether a number of these issues were hidden, ignored or just not acted upon appropriately at an early stage, or most probably a mixture of all three."
Similarly, MPs complain of problems on central government being hidden, ignored or not acted upon with the necessary degree of diligence. Since the NHS's national programme for IT was announced in 2002, doctors, IT specialists and MPs have complained - to no avail - that health officials release unrestricted amounts of good news on the project while giving away few hard facts on its problems, risks and challenges.
Within Haringey Council, general knowledge among some councillors about Tech Refresh was so scant that those whom Computer Weekly spoke to had no idea that Deloitte and Touche's auditing arm is the council's main internal auditor and its consulting operation is a major contributor to Tech Refresh, along with Northgate Information Solutions.
Nobody can be surprised that most councillors had little idea what was going on. Last year, a council report extolled Tech Refresh as a success apart from some "niggles".
"As reported last month, on capital there is potential slippage and subsequently additional costs on the Tech Refresh project," said a council report in October last year, reported on 20 December 2005.
"The roll-out of PC replacement is now well underway, and while good progress is being made some niggles are being experienced which have been highlighted in the risk monitoring process. An overspend of £0.5m is currently projected."
In January 2006 the council received the Audit Commission's report on Tech Refresh. At this point the top tier of officers and councillors ceased to refer to the project being marred by mere niggles.
"Members will see that there were a number of systematic failures in managing a programme of this size," said a paper to the council's 18 January meeting on the findings of the Audit Commission on the Tech Refresh project.
It was the first time some councillors had realised that the cost of the project had more than doubled, and that 140 change requests with a value of £7.1m had been raised. Four requests alone cost £4.7m, over which auditors could find no evidence of any discussions having taken place at project board level.
"It would be reasonable to expect changes of this magnitude to be discussed at project board level," said the Audit Commission. "But the audit trail for such discussions is lacking."
A large number of change requests - in which the customer and suppliers agree to change software, scope or specifications at extra cost - were submitted and approved retrospectively. One example of this was a retrospective change request for £32,000 to cover the cost of running an information stall at the council's 2004 summer event.
"It is clear that the council's project leader was able to authorise a significant amount of change requests before any form of scrutiny was applied. A number of change requests do not have a business sponsor. This suggests that the level of segregation between request and authorisation was not adequate.
"A significant weakness identified in this area is that a number of change requests have been submitted and approved retrospectively. The lack of clarity around the status and control of change requests appears to have been a factor behind the cost overruns incurred by the project."
In the early stages the council did not keep only councillors and its council taxpayers in the dark. The project board lacked hard financial information on the project. Budgets were reported only in terms of days used; and when budgeted days were overspent there was no acknowledgement of the financial implications within the accompanying notes. "By September 2004, the highlight reports had ceased to provide even the information on days spent," said the Audit Commission.
Some councillors who wanted to know whether the project was within budget relied in the main on reports from the financial and performance committee, and the E-government Advisory Committee. But in the early stages of the project, reports of the advisory committee contained only a brief comment that expenditure was being contained.
In the later stages when difficulties were apparent to officers, no mention was made of the financial position of the project, said the Audit Commission.
Reports of the Financial and Performance Committee also provided inadequate information. These reports and a May 2005 briefing of the assistant chief executive "demonstrate confusion over the true picture of costs with varying levels of over and underspends being reported."
But the Audit Commission's report does not mention what many IT project management experts will see as the most worrying aspect of Tech Refresh. It is the absence of any information on the doubling of the project's original budget until long after it occurred.
The full council only had a clear view of the project's weaknesses, including the lack of controls, when the Audit Commission reported its findings last month.
One is left wondering how many other central and local public authorities are awarding work on the basis of unrealistic estimates of costs to IT suppliers, a downplaying of risks, inadequate controls on suppliers and consultants, poor quality of reporting to elected representatives, and non-adherence to standards on good management practices such as Prince2 methodology.
The council leaders said they planned to act firmly and quickly on the commission's report. For example, they said they will "review the procedures for authorising and controlling change requests for all projects".
But there are few signs that the report of the Audit Commission has led to any deep-rooted change of direction when it comes to openness and accountability.
For example, the council's Executive Committee - a small group of Labour councillors and officers - met this month and discussed the authority's future IT infrastructure arrangements. As little has been published on the results of the meeting, Computer Weekly asked some opposition councillors, who comprise 16 of the total of 57 councillors, what the discussions of the Executive Committee were about.
They did not know - and the council declined to comment. A change in culture within the London Borough of Haringey - or central government for that matter - is a long way off, if it ever comes.
The lessons of Tech Refresh and Haringey Council
On the basis of its experience with the Tech Refresh project, the council needs to improve its procedures in a number of areas.
In particular, the council needs to:
- ensure that budgets, in particular the revenue costs associated with large capital projects, are realistic from the outset, and subject to adequate challenge during preparation;
- ensure that project budgets are coherent and that monitoring arrangements are robust at the day-to-day management level, with financial management roles and responsibilities clearly defined and allocated;
- review its procedures for authorising and controlling change requests for all projects;
- ensure that major revisions to project budget estimates are reported, reflected in formal virements and appropriately authorised. It would be appropriate for the council to review its delegated authorisation levels to ensure that adequate reporting to members is undertaken;
- establish the costs expected to be incurred against key deliverables, and monitor these against actual costs;
- provide for the representation of corporate finance on the project boards of major schemes;
- consider the use of subject matter experts to challenge the design of future projects and give independent external challenge;
- ensure that a robust project board is established with those nominated being able to commit the time and having the appropriate skills;
- introduce a robust mechanism for quality and project assurance which is independent of the project;
- ensure that project board reports cover project costs against budget for project staff, meetings, expenses, overtime, quality assurance staff, user testing, consultancy, hardware, software, installation, infrastructure, licences and temporary workers;
- ensure that a clear audit trail exists for decision making within projects; and
- consider whether a programme or project management approach is most appropriate at the outset of significant future projects.
Source: Audit Commission, Review of Project Management, Haringey London Borough Council, Audit 2005/2006
Audit Commission's key findings
We have identified two key areas - change management and variation orders - that have contributed to the additional costs of £10m, reflecting inadequate project specification and project management.
We concluded that there was limited evidence of:
- regular attendance by some project board members at project board meetings, which impacted on continuity and ownership;
- sufficiently senior project sponsorship;
- adequate staffing resources being allocated to deliver the project;
- robust challenge to additional costs arising during the project implementation;
- adequate input from corporate finance to either budget setting or budgetary control;
- clear thresholds for authorisation of variations to costs of the scheme;
- application of appropriate budgetary control mechanisms, including provision of suitable financial information;
- timely, transparent and accurate reporting of the project slippages and overspends; and
- clear audit trails."
Source: Audit Commission, Review of Project Management, Haringey London Borough Council, Audit 2005/2006