Office of Government Commerce review of ID Card system identifies "amber" cost risks
The Office of Government Commerce (OGC) uses a red, amber or green traffic light system in conjunction with its reviews of all IT projects which are subject to a "gateway review" (this is an independent assessment of the risks associated with a project). The OGC has given the ID Card system the "amber go-ahead", a status which is the only logical conclusion if information given to the House of Lords by Baroness Scotland is carefully deconstructed. The risks associated with the ID Card project's amber status have not been included in the ID Card project cost estimates issued by the Government.
The OGC web-site posits three possible statuses for any major IT project:
- A red status which would mean that "To achieve success the programme or project should take remedial action immediately";
- An amber status which is defined as "The programme or project should go forward with actions on recommendations to be carried out before the next OGC Gateway Review"; or
- A green status which is defined as "The programme or project is on
target to succeed but may benefit from the uptake of the recommendations".
On 16 Jan 2006, Baroness Scotland of Asthal confirmed during the ID Card Bill's passage through the House of Lords, that the ID card programme had been "subject to that regular review under the Office of Government Commerce gateway review process" and that "the review teams have full access to the business case for the identity cards programme". She then continued "I can announce that, just last week, a further gateway review of the identity cards programme was completed and I am pleased to say that the review team concluded that the programme is in a fit state to proceed". Baroness Scotland continued "it is not usual for the gateway process details to be expanded upon or disclosed".
We are in a position to provide some expansion. Clearly if the ID Card project had been given the red status (i.e. perform "remedial action immediately"), then this would not be consistent with the Ministerial statement. Similarly, if the OGC had given a green status (the ID Card project "is on target to succeed"), then the Ministerial statement that "the programme is in a fit state to proceed" is incredibly understated and very reserved. Would it not be the case, we conclude, that if the ID Card project was "on target to succeed", isn't that something which Ministers would trumpet loud and clear in order to bolster public confidence in the system and to deflect the criticisms from detractors?
Thus if it is not red nor green, it follows that the ID Card project has the amber status.
The OGC provides the Red/Amber/Green status as a summary way of quantifying the risks of a project combined with the impact of that risk if it ever occurred. An amber status means that the OGC has identified either some low probability risks with a high impact (e.g. something that would be very costly to put right but is unlikely to occur) and/or some high probability risks with a low impact (e.g. something which is inexpensive to correct but could happen often) and/or some medium impact risks with a medium probability of occurring.
The OGC also identify three methods of responding to these risks. The first is to transfer the risk to another party, and this might arise when the technology being used is innovative. The OGC warns that such risks "should not be transferred until they are clearly understood" because "a premium may be paid when a risk is transferred to another party". The second way of responding to a risk is to avoid it — but that might have "serious consequences for the project" (e.g. system "redesign"). The final way is to reduce the risks — and this might take the form of a redesign of the system.
In the context of the ID Card system the amber status has implications for the cost estimates for the scheme. Irrespective of what method is used to counter the risks — whether these risks are transferred or systems are redesigned — these cost implications remain unquantified.
Last year the London School of Economics (LSE) produced one cost assessment of the whole project which was criticised by the Government as being "mad". In response, the Government published cost figures, audited by KPMG, which relates only to the Home Office costs of running the system (i.e. unlike the LSE report it excludes the costs of other Government Departments).
However, the KPMG report indicates that the Government costings have not considered a risk based approach — even the risks associated with the "amber status", Instead these risks are subsumed into a general "flat 20% contingency factor" which would be insufficient if the worst happened. Indeed, the KPMG report explicitly recommends that "a more detailed risk-based approach, such as a Quantitive Risk Analysis (QRA), should be considered for the Scheme total cost estimation or, at least, in relation to operating costs" and if this cannot be achieved "as a minimum, it would be useful (for the ID Card team) to consider a number of risk-based scenarios".
Last month, the House of Lords amended the ID Cards Bill to include a provision which states that the scheme should not go ahead unless Parliament has considered an independent, risk-based, cost-benefit analysis of the whole ID Card project produced by the National Audit Office. The Government used its majority in the House of Commons to overturn this amendment on 13 February 2006.