Alan Calder on IT Governance, information security & ISO 27001

Confusion apparently surrounds the future of the job running the NHS’s £12.4bn flagship IT programme, and the timetable for the departure of director-general Richard Granger.

Wouldn’t it be nice if there were proper leadership of the NHS? But, as the NHS is increasingly run from 10 Downing Street, indecision and interference will get increasingly worse. And there’s every chance that the CfH programme will, without proper leadership, lose its way and we’ll see any improvements that have actually been achieved whither away.

It is interesting to note that the “spin-free” new administration of Gordon Brown may be making moves to sweep the NHS IT reform programme under the carpet. The recent resignation of the forthright Richard Granger at Connecting for Health has removed a lightning rod for the project and it is now reported that two of its most vocal government supporters have been moved to other roles.
Here is the striking thing: OGC (Office of Government Commerce) is the developer and owner of two world-recognised best practice frameworks: Prince2, for managing IT programmes and IT projects, and ITIL, for IT Service Management. Prince2 was developed to help government IT projects come in on time, to budget and on specification. ITIL focuses on the need to understand customer (i.e. user requirements) and to develop and deliver services that align with business needs. Both are part of a normal IT governance framework, and both have quite signally failed in the NHS Connecting for Health programme.

We’ve seen Grainger go, and others moved on, but we haven’t seen any overt attempt to rectify the governance failures that led to the current parlous situation in which a national project is behind timetable, over budget and not meeting specification. A delivery-focused government would start off by overhauling the governance framework put in place for this framework, not just on changing faces – maybe Brown and his ministers need a lesson – from one of their own departments – on how these things should be done.

Following the apparent derailment at Connecting for Health, let’s hope that another prestigious national project fares rather better with its systems delivery. The Olympic Delivery Authority is said to be close to selecting an information systems supplier, with Accenture amongst the contenders (better luck this time). I hope that the ODA will research the NHS experience as a case study in how not to do things, and ensure that proper IT governance processes are put in place and adhered to.

If Health Service IT systems run two years late, we give a weary shrug and sort of expect it. If the Olympic systems aren’t ready on time, it will be national humiliation on a global stage. IT governance is about managing that sort of risk.

Accenture has decided to walk away from its £2 billion contract to help modernise the National Health Service’s IT systems. A termination deal has been worked out in which it will pay only £63 million to its government client, Connecting for Health – a lot of money, but presumably better than it could have been.

But what a shocking indictment of the IT governance within this flagship project: one of the world’s top IT consultancies prefers to cut its losses despite such major cost to itself, while the project itself is already running two year late. I imagine that CSC, which is taking on Accenture’s role, will be looking for major assurances that the project goalposts will stay fixed henceforth.