i6 Programme

I am happy to start on that. If the committee wants a bit more detail, I will pass over to someone who knows more than I do about the technical detail.

The bottom line is that there was a vendor change, which affected hardware that was supplied by an external supplier—not Accenture, in other words. The supplier introduced a change of conditions for that piece of hardware, which meant, in effect, that it was not going to support it in the long term.

That caused some concern for us, as we would have been moving forward with a brand-new facility with hardware that was reaching the end of its life. The situation was unforeseen—nobody saw it coming. It does not affect just i6 or indeed just Scotland—it is a global issue. As a consequence, we were faced with a decision on what to do.

Clearly, the situation necessitates changing that particular component, and the real question is whether we do that now or later. The assessed position around such things—bearing in mind the scale and length of the project roll-out—is that the level of risk to the business from making the change after going live would be pretty considerable.

On all reasonable measures, it is better for us to make the change before we go live. In essence, that was the decision that was taken. We will receive an alternative, which will not affect us cost-wise at all—in fact, the component that we will get instead is actually of a higher specification than the one that we had planned to use. There is no other difference in terms of compatibility, which remains exactly as specified.

However, the move involved a change in the planned delivery. As you will recall, we had intended to run what we were describing as a pilot in K division prior to going live. That was ostensibly just to test some of the faults and to ensure that the live operation was seamless before the system went live. The change of hardware meant that we could not do that according to the initial plans.

That said, we have developed an alternative approach that we believe will be every bit as robust. Prior to going live, we will have full confidence in the equipment.

Yes.

It is a perfectly valid question. As the gentlemen sitting on my right and left know far better than I do, it is a reality of the delivery of any kind of ICT capability that things are subject to change and they evolve all the while.

We could not have foreseen the change that I have just described; it was out of our hands. It is one of those things with which one will occasionally be confronted, and we just have to ensure that there is sufficient flexibility to allow us to adapt to the change and still move forward according to plan without significant change to our intended outcomes. We have been able to do that on this occasion. I cannot promise that we will not be faced with anything else in the future but, according to our assessment, there are some safeguards in place in terms of the contract.

To be clear, it was not us who procured the original piece of hardware—it was the company that we had contracted to do the work, albeit that we were involved in the agreement about what kind of hardware was required. Ultimately, there are safeguards in place so that, if we were faced with that kind of eventuality, discussions could take place to mitigate our exposure.

Yes—I believe that our contract is very robust.

The supplier for i6 is Accenture, which is our primary partner.

Well, I would not go so far as to say that. The contract is robust in making sure that we take our own respective responsibilities for delivery—that is all written into the contract.

Yes, that is right.

As you know, and as we have discussed at this committee previously, there have been a number of twists and turns on this long journey. The contract has been pretty robust throughout that journey, and it has kept us in a very strong position. I believe that that is still the case as we sit here today.

Yes. Negotiations took place between our distributor, the manufacturer of the kit that is being discontinued and the manufacturer of the kit that we are bringing in to replace it. Those are two separate manufacturers. The company that is discontinuing the kit has agreed to provide a refund of the money that was originally put towards it, and that money has gone to the other company to provide us with kit that is actually of a higher specification than the original kit.

The decision for us to swap out in advance of launching i6 is absolutely the right decision, because the kit that we were originally going to use was going to come to the end of its life, so support for it would have been withdrawn during the first year of the i6 launch. It was an absolute no-brainer for us to ensure that the kit was swapped out in advance so that we have kit that is fully supported throughout the project’s duration.

To answer Mr Finnie’s question about whether the same thing is likely to happen with other stuff across the board, in all my years in industry, it is pretty unique to find that something that is sold and developed as a flagship product has been withdrawn by the manufacturer. It is a unique situation, but it is a unique component part of i6. The other hardware solutions that we have in place have full product life cycles ahead of them, guaranteed by the industry. It is a unique situation, and I would be very surprised if anything like that happened again.

It is a part of storage. Within the i6 portfolio, part of the system is used to search all the data that is gathered. Members know the size of i6 and have the briefings in front of them, so they will know that there is an incredible amount of data, covering people, objects, locations and events across every action that is entered into the system. We need a way to search that when it is in the system and, to do that, we need a big disk for it to spin on. In essence, it is storage. To try to put it into non-technical terms, it is a big disk that we store everything on that will allow us to search quickly and pull something back. If someone wants to look for a red car that was involved in an incident at a particular time, the system will be able to look into that and pull the information straight back out for us. It is a key component of the system and the searching facility.

I hope that that was not too patronising or too technical.

Yes.

Yes. I am de-speccing the technical description significantly.

It is something called a storage array. I said that it is a big disk, but it is actually several disks that plug into one big thing that controls them. That is the component that we have had to replace or swap out.

It is a physical thing. It is not software. It is a piece of kit. In years to come, we can add more to it so that we can have a bigger storage facility.

Thank you.

That might just be a matter of wording in the briefing note. The go-live date is 7 December. That has consistently been the date and that is what we have been planning towards. Go-live is 7 December. The term “roll-out” simply describes the period, which will be the best part of a year, in which we will ensure that the i6 capability is available across the Scottish geography, so that all policing areas have access to and can use i6. That is what is referred to when we talk about roll-out. Clearly, the roll-out will start on go-live, but it will not be completed for several months thereafter.

That is a good question. I will ask Hamish MacPherson, who is the programme manager, to unpack that a little in a moment. However, to clarify, it would be wrong to say that, as a consequence of the change of hardware, we are moving ahead without testing the system. That is not the case. We planned to do what we described as a pilot. In effect, that would have been rolling out the capability within a defined operational area to test that it actually does what it says it can do. That would have been in an operational setting. We have had to pull back from that original plan, but we have replaced it with an alternative, which we have described as a model office.

I ask Hamish MacPherson to unpack the detail of that.

13:30

I will touch on both issues, if I may. The user acceptance testing that I discussed with the committee previously has continued. Obviously, it will be paused when we swap out the equipment, but it will continue. We will still go through the same number of scripts, which cover every test condition that our test manager has identified is required to prove that all the requirements within the original contract are met.

The bit that is problematic is that we were then going to do what was basically a pilot. The pilot is not user acceptance testing. Having tested the application, it is about how the application works in an operational environment along with all the processes that underpin it. When we have a custody, we will still print a custody form, file it, and so on. There is still quite an important piece of work to do before we roll out i6 across the whole of Scotland to make sure that it actually works with the processes. Frankly, we still have eight different processes across the systems of the eight different legacy forces, so it is really quite important that we nail the process part. Obviously, we are not keen to do that while replacing the hardware—that would just be folly and would introduce risk. Instead of that, we have replaced it with model office testing.

We have a full custody bar in my office in Anderston, which is where the project is run from. We have identified lots of different processes that we want to test and that we would have tested in K division in the go-live. We have replaced that with the model office testing, which is all fully scripted. Basically, staff will run through those scripts to ensure that all those processes are followed, if that makes sense.

My preference would always be for a combination of both, to be honest with you. I quite like model office testing anyway—I have done that with previous projects—followed by supporting a go-live in an operational division. For that reason, we have reduced the 7 December roll-out. We were originally rolling out i6 in two divisions on that date, but we are reducing the roll-out to one division and increasing the amount of business support resource that will be supporting that go-live. I do not see that as introducing any further risk. We should be able to support that risk when we go live.

Yes.

The same period as before—the contractual period between go-live and roll-out finishing on 29 August next year is still the same.

Yes. Every go-live will be supported by the same resources. As we roll out, the business support resources will roll with the project and will move into the next division to support it. Each division in turn has also identified a number of staff to support its own roll-out, so more highly trained people from each division will be floor walking to support staff during that period. That is not a change from the original plan—it was always the intention.

I will let Hamish MacPherson give a detailed answer to that, but I would like to make a concluding comment after he has done that.

Sorry—

I am quite happy to accept the question. Last time, I tried to take you through a test cycle and explain how a test cycle works within a software programme, where several parts of the test cycle are the responsibility of the supplier.

As something is built, the supplier will carry out unit testing, which involves testing the individual components. The supplier then links the components and carries out assembly testing. It then carries out a product test, which is a factory acceptance test of the application. The supplier is responsible for all that.

User acceptance testing is our responsibility. We go through test scripts that match the operational environment. The point that I am sure Mr Richardson, too, will make is that, when we finish product testing, we should have no critical or major faults.

As we said in the paper that we gave you, we found in user acceptance testing that we have a higher number of defects than we would have expected at this point, including major and critical defects. Obviously we will never go live with major, minor or critical defects. That is an issue for the supplier, so we have challenged the supplier to say how it will bring down the defect rate in time for the go-live date. That issue is with the supplier. The result of that is that bits of user acceptance testing have been problematic because we have had scripts blocked with errors—

That is exactly what it is. A basic example might be the recording of a crime. We need the user to enter the system and record a crime, then test to make sure that the crime recording works perfectly, having recorded the crime and attached an accused to it. Having done that, we create a standard Scottish prosecution report and we test that report. Having created that, we send it to the procurator fiscal through interface testing and we receive a statement request. After we receive a statement request, the case is split up between the officers and the officers complete their statements.

That is just one example. We would do the same for a missing person or a vulnerable person and so on.

There are a number of defects in the system that are stopping those processes. For instance, part of the interface between the creation of a prosecution report and passing it to the procurator fiscal is faulty, so the data is not appearing in the right fields. As a result, the manufacturer has to go back and sort the defects. There are always defects at this point in a project, but these ones are of a higher magnitude and criticality than we would have expected. Some of them are major defects that stop the scripts running. That is the issue.

I would like to top and tail that. I am grateful for the committee’s sustained interest in i6. It has been helpful for us to keep the profile high and keep the necessary momentum. It has also helped to reinforce the criticality of the programme.

Indeed, but that is the reality. You have heard me say it before and I will say it again: the programme remains on scope, on budget and on message and we are following a schedule for delivery. All that is great and Audit Scotland has picked that up and used i6 as an exemplar in a recent publication. I hope that the committee will take some reassurance of the rigour that has been put into making sure that what we are doing delivers the outcomes that we are seeking.

In the context of the discussion about defects, I should highlight that we have always acknowledged the complexity, size and scale of the programme. There is no doubt about that. At the same time, we expect there to be an effective level of contribution to address difficulties and overcome the unforeseen obstacles as the project moves forward. At the moment, the supplier has perhaps not been delivering the performance that I would have expected in breaking down some of the defects within the timescales that we expect. As a consequence, there was a fairly robust board meeting on 28 August.

Accenture has been consistent in its message that the problems can be resolved and that it can draw down enough resource to deal with the issues prior to go-live. However, the experience that we have had so far has given us cause to challenge the quality issues and the overambitious approach to certain things. As a consequence, I was not reassured at the board meeting that Accenture’s proposed plan was credible and would enable it to do what is necessary for us to go live on 7 December. That is a fairly significant issue and I have asked Accenture to come to a special board meeting on 15 September. At that meeting, I will expect Accenture to provide plans and an overwhelming assurance that what it has in place will enable it to do what we require it so that we can go live on 7 December. It would be wrong of me to come to the committee and not flag that up.

Just to moderate that, however, the committee knows from earlier discussions that the journey has been incredibly difficult. In 30 years of policing, this has been the most complicated delivery programme that I have ever experienced and that continues. In a sense, therefore, I do not really want to put flags up.

Accenture has been consistent in its message that it can do what is required. At the board meeting, it also indicated a confidence rating for delivery in excess of 90 per cent. What I am describing to you is just the rigour of the programme arrangements. At the moment, we are not satisfied that what is being presented is of the appropriate quality and, therefore, we will come together on 15 September. If, on 15 September, Accenture secures our confidence, we will carry on exactly as we have highlighted to you. If not, we might need to consider some revision. If that happens, I will clearly inform the committee.

There are contingencies just because of operational realities. Unforeseen things can happen that mean that we cannot progress training. This situation is no different from that, so, irrespective of what I have described, a degree of flex was built into the training requirement from the outset to enable us to adapt to what I am certain will happen anyway—life events and events to which the police will need to respond.

Perhaps Hamish MacPherson will provide some further detail on that.

I would not be doing my job if I did not build in some kind of contingency, so there is contingency in the hardware swap-out, for example. There is also contingency in the general plan that takes us up to 7 December and we have contingency thereafter.

As Mr Richardson said, the supplier says that there is no reason to have concern about movements just now because it has resource. In the past, we have had a high level of defects in product testing but quickly turned on resource, burned those defects down and held the date. However, it would be foolish of us not to plan some contingency, so we have contingency in training in as much as we can extend the time from the first person being trained to the go-live date and still fall within best practice for training, if that makes sense.

I apologise. I meant “resolved”.

Yes.

There is full back-up. We have back-up solutions that will safeguard against any data loss and allow easy recovery. There is legislation about how long we should retain data and when we should destroy it, so our back-up solutions have all that fully built in.

Yes. The i6 data model operates between two main data centres. Obviously, I cannot give you the locations in public.

Data will be replicated between those two centres.

You will notice that your briefing papers refer to something called the i6 data access project—iDAP—which uses technology that allows us to access legacy data in real time. If anyone is looking for data records that are four, five or six years old, for example, that information will be accessed from the legacy data sets and produced in real time on the system.

No, the user would not know that they were browsing an external data set. It will all be as if they were browsing the original i6 database.

Do you want to expand on that, Hamish?

There are no delays in that. It is completely on track. It is a roll-out. The intention is that, when i6 goes live, it will cover vulnerable people specifically. We have a national vulnerable people database and, as i6 rolls out, some people will be on the existing system and some will be on the new one, so it is important that the people who are on the existing, interim vulnerable people database are able to see the stuff that is in i6 and vice versa. Vulnerable people will be on the system from go-live, as will missing people so that we have a national view of them too.

As the system rolls out and, to be blunt, based on the economics of when a legacy system’s software renewal is due, we will replace the other data sets. By the time the last of the legacy systems is due to be decommissioned, the whole of iDAP will be formed and all legacy data will sit within it.

Notwithstanding what I have said already, the process is always subject to variation and change. The journey so far has presented a series of challenges that we have had to find ways to overcome, but we have done that and managed to stay on message.

The committee is aware that i6 represents a game-changing capability and is a generational shift for all police officers and staff who deliver services. The prize is therefore incredibly great, and the priority for delivery is as strong as it can be. I would like the committee to take some reassurance that we will move heaven and earth to ensure that the programme is rolled out and provided to staff across Police Scotland as expeditiously as possible. However, I absolutely guarantee that we will be around this table again in the future talking about other unforeseen changes that will undoubtedly happen.

That is absolutely right, but we have gone through a great deal of work with the i6 programme. The system is constructed—it is designed and built—and we are at the testing stage, so there is already significant momentum. On the change as we move forward, we should take some confidence from the fact that although the K division pilot as described has been changed, the work that K division officers did was exceptional. They were in a position of readiness, and they made appropriate communications; people were ready to roll with that pilot. I was considerably reassured; if that is an indicator of how the other divisions will absorb the requirement when they reach that point, it is a real reason for optimism.

There is probably a blend. I will let Hamish MacPherson answer that question. Accenture is our primary contractor—

Yes, that is correct.

Perhaps I can answer that question, convener. The go-live date of December is a contractual go-live date. The previous milestones regarding the pilot—

I am sorry, convener—I was trying to come to that, to be honest.

As soon as the date passes in December, if the system is not fit for roll-out in our first contractual go-live, the supplier is automatically liable to pay a penalty.

Penalties can be attracted from that directly to Police Scotland.

Each of the milestones has penalties against it, including the final roll-out.

Obviously, that is a commercial matter. Let me put it this way: Accenture would not want to reach that position.

We would certainly not hope to have to cover that situation. For clarity, on the issue just now regarding the hardware, the contract is a turnkey contract through Accenture. The hardware was specced by it, but agreed by Police Scotland.

There are significant contract points that would make it particularly unattractive to run past any of the milestone dates after the go-live date.

Agreed.

When i6 is rolled out fully, we will have a single integrated custody system across Scotland and anybody will be able to see the whiteboard of the custody suite. Obviously, to reach that point, roll-out must happen. The first divisions to go live will gain the benefits of i6 at that point, but the others will not. However, we have in place business processes to maintain the visibility of people in custody across Scotland. I do not claim to be an expert in that area—obviously, it belongs to the custody division—but my business-change staff work with the custody division to deal with those business-change elements during roll-out,

There is absolutely no doubt that i6 underpins reform and is critically important to enable national capabilities. However, i6 is not the only area; there are a number of areas in which interim measures had to be put in place. It will be some time before all the previous force areas can communicate in a slick common fashion.

We have made significant progress around trying to address as much of that as possible in a prioritised way. I do not want to wag fingers in terms of legacy arrangements, but the reality around trying to deliver national solutions in the legacy set-up was inordinately difficult because there was no single line of decision making. There were few successful deliveries of national programmes under the previous arrangements. Since Police Scotland came into being, we have rolled out 21 national systems. Some are interim arrangements, but they have enabled communication and a flow of information and processes across various business areas.

There are still some areas where there is a less than optimal reality for staff, who might have to duplicate work to some extent. However, we have plans in place to address that. Once i6 comes on stream, along with other elements that enhance the process, much of that will be reduced.

It is important to stress that none of this happens overnight; the i6 system has been on the books for six years. That is how long it has taken us to get to that point of delivery. I guess that we need to be realistic and patient about how we can address all the concerns nationally.

The situation will be different in different parts of the country. It is difficult to say without an exact—

The Dumfries and Galloway system will be replaced when i6 rolls out. Before then, the police there will maintain the current system. It is not the most efficient way of doing things, but it is, as you say, part of a belt-and-braces approach to ensure that people are kept safe within custody.

We would always consider such things. What we would not want to do is create efficiency by introducing risk. There is always a balance to be struck.

The simple answer to that is yes: we certainly are. However, we are not waiting until the end to do a post-implementation debrief. This is an on-going reality for us, so we examine the learning at various stages and make adjustments as we go. The process will continue to be difficult, and it will take some time before we get to the ultimate roll-out position. I have no doubt that we will need to remain focused and to put in the effort in order to get the outcomes that we seek.

On a number of occasions, I have been in discussions with people from outwith policing about our general experience. Sharing that sort of learning in the public sector context in order to help others to avoid some of the pitfalls is incredibly worthwhile.