Forty-Sixth Report Government preparedness for the COVID-19 pandemic: lessons for government on risk

The pandemic has demonstrated variability in departments’ risk management. A recent cross-government review of risk management by the Government Internal Audit Agency highlighted significant variability across departments, including the 6 Government preparedness for the COVID-19 pandemic: lessons for government on … Read more The pandemic has demonstrated variability in departments’ risk management. A recent cross-government review of risk management by the Government Internal Audit Agency highlighted significant variability across departments, including the 6 Government preparedness for the COVID-19 pandemic: lessons for government on risk extent to which senior leaders promote and support risk management, departments’ capabilities, and their degree of alignment to the Orange Book, the government’s guidance on risk management. We are surprised that there are no uniformity in government’s high-level alignment with the Orange Book and a seeming lack of appreciation for the principles of the three lines of defence model. Before the pandemic, departments lacked an agreed understanding of risk tolerance, such as which consequences of a pandemic they deemed acceptable and which consequences they needed to mitigate. It is only after departments started responding to the crisis that they reached a shared understanding of the objectives and priorities they should focus on. Recommendation: The Cabinet Office and HM Treasury should set out what they intend to do to ensure that there is sufficient uniformity in department’s high-level interpretation of and alignment to the principles of the Orange Book. As part of this, the Cabinet Office should set out how it will ensure that departments have a shared understanding of the government’s tolerance for the impacts of major risks, including what levels of impact are acceptable and what levels of impact require mitigation. Show less

There would be significant benefits in improving the public’s awareness of the main risks facing the country and what government is doing about them. The public and Parliament have limited awareness of the main risks facing the country and of … Read more There would be significant benefits in improving the public’s awareness of the main risks facing the country and what government is doing about them. The public and Parliament have limited awareness of the main risks facing the country and of what government is doing to address them. Although government has published a public-facing national risk register since 2008, this document is not widely known. Our witnesses recognised that government has a chequered history in communicating risks to the public and acknowledged that the government’s messaging on risks should be more balanced, accessible to non-experts and lend itself to practical actions. Greater public awareness of government’s planning for major risks, including the work it will carry out as part of the nascent catastrophic emergencies programme, would help avoid complacency, focus the minds of the officials who are tasked with risk planning, help to ensure the public is more aware of what is being done to protect them from harm and highlight opportunities for public engagement, awareness raising and behavioural change. The Government carried out a consultation last summer on a national resilience strategy and had over a million different interactions with it. This demonstrates a high level of public interest in these matters. Equally MPs collectively received hundreds of thousands of emails at the start of the lockdown, largely because the Gov.uk website did not provide clear and intelligible advice, or provide effective mechanisms for MPs to raise constituents problems. Recommendation: The Cabinet Office should set out how it plans to increase public awareness of the main risks facing the UK. It should also report annually to Parliament: • on what actions government has undertaken during the year to mitigate the risks covered by the catastrophic emergencies programme and provide an assessment of government’s preparedness for each risk; • what changes Government in making as a result of its consultations o Show less

The pandemic has highlighted the critical role of international collaboration for managing the risks that the UK faces. Given the increasingly interconnected nature of our world, several of the main risks facing the UK may originate abroad and, if they … Read more The pandemic has highlighted the critical role of international collaboration for managing the risks that the UK faces. Given the increasingly interconnected nature of our world, several of the main risks facing the UK may originate abroad and, if they materialise, will require a coordinated international response. To detect them and respond to them effectively, government needs to strengthen the exchange of information with other countries, cooperate on horizon scanning and the early detection of threats, and learn from the experiences of other countries. It will also need to foster international debate on medium and long-term existential risks to humanity, which can only be addressed through concerted global action. Promoting greater international collaboration will require the UK to play a more prominent role in international forums, such as the World Health Organisation. Recommendation: Government should set out how it intends to drive greater international collaboration on risks, including exchanging information on threats, promoting and integrating mutual learning and coordinating responses across borders. Show less

Government would have been better prepared for COVID-19 if it had applied learning from previous incidents and exercises. Government was unprepared for a pandemic with widespread asymptomatic transmission, but this was not unprecedented. The early spread of HIV, too, was … Read more Government would have been better prepared for COVID-19 if it had applied learning from previous incidents and exercises. Government was unprepared for a pandemic with widespread asymptomatic transmission, but this was not unprecedented. The early spread of HIV, too, was partly caused by the fact that it was an asymptomatic condition that could take months before being diagnosed. While government took action following major simulation exercises such as Cygnus and Winter Willow, it did not act upon exercises Valverde, relating to novel coronavirus, and Alice, relating to Middle East respiratory syndrome (MERS). This resulted in a lot of PPE in the Governments strategic stocks which was not suitable for Covid, although the department said it was still able to use “a huge amount of it”. We are not convinced that government has learnt lessons from its lack of planning. For instance, it is unclear whether government would be able to reinstate the Coronavirus Jobs Retention Scheme at short notice without the implementation issues incurred when the scheme was first introduced. Recommendation: The Cabinet Office should set up a cross-government process to capture learning for emergency preparedness and resilience from exercises and actual incidents, including COVID-19, and to allocate clear accountabilities for applying learning. It should report annually on the implementation of each learning point. Show less

Government’s slow progress in improving data quality and completeness has hampered its preparedness for this and future pandemics. We have repeatedly highlighted longstanding issues with the quality of data held by government and with its ability to use data effectively … Read more Government’s slow progress in improving data quality and completeness has hampered its preparedness for this and future pandemics. We have repeatedly highlighted longstanding issues with the quality of data held by government and with its ability to use data effectively to support policy interventions. Our 2019 report Challenges in using data across government noted the lack of government-wide data standards, ageing IT systems, fragmented leadership, and a civil service culture that does not support sharing data across departmental boundaries. For instance, the contact centre that government set up a part of its programme to support those most vulnerable during the first lockdown could not get in touch with around 8 Government preparedness for the COVID-19 pandemic: lessons for government on risk 800,000 individuals due to missing or inaccurate NHS records. The lack of progress on data issues over the years is likely to hinder government’s initiatives to improve preparedness. While government has set up a National Situation Centre which will provide real-time access to the data government needs to respond to emergencies, this will bring limited benefits if the quality of the data collected remains low. If government access to key data—such as social care data—is scaled down following the pandemic, this will further hinder preparedness for future emergencies. Recommendation: The Cabinet Office should set out its assessment of the areas in which the data collected by the National Situation Centre are in greatest need of improvement and what it plans to do to implement those improvements. As part of this response, government should set out how it plans to retain access to the social care data required to respond to future pandemics. Government preparedness for the COVID-19 pandemic: lessons for government on risk 9 1 Lessons on risk management and communication Show less

On the basis of a Report by the Comptroller and Auditor General, we took evidence from the Cabinet Office and the Department of Health & Social Care (the Department) on the government’s preparedness for the COVID-19 pandemic.1

The three lines of defence model of risk management, widely used in the private sector, sets out what the Orange Book characterises as a “simple and effective way to help delegate and coordinate risk management roles and responsibilities within and … Read more The three lines of defence model of risk management, widely used in the private sector, sets out what the Orange Book characterises as a “simple and effective way to help delegate and coordinate risk management roles and responsibilities within and across the organisation”.8 Under the first line of defence, management has primary ownership, responsibility and accountability for identifying, assessing and managing risks. The second line of defence consists of functions, such as organisations’ risk and compliance teams, that monitor and facilitate the implementation of effective risk management practices and facilitate risk reporting. Internal audit forms the third line of defence. The Cabinet Office expressed support for the three lines of defence model and told us that it plans to carry out a pilot in 2022 to strengthen the third line of defence by introducing audits or assessments of departments’ planning for emergencies.9 Show less

The NAO found that, before the pandemic, departments lacked an agreed understanding of risk tolerance, such as which consequences of a pandemic they deemed acceptable and which consequences they needed to mitigate. The Cabinet Office agreed that government reached a … Read more The NAO found that, before the pandemic, departments lacked an agreed understanding of risk tolerance, such as which consequences of a pandemic they deemed acceptable and which consequences they needed to mitigate. The Cabinet Office agreed that government reached a shared understanding of the objectives and priorities they 3 Qq 28, 55–60, 74, 80–83 4 C&AG’s Report, para. 3.14; Q 70. 5 C&AG’s Report, para. 4.2; HM Government, The Orange Book: Management of Risk – Principles and Concepts, February 2020 6 Qq 86–95 7 Government Finance Function, Good Practice Guide: Risk Reporting, August 2021; Risk Appetite Guidance Note, October 2020, revised August 2021; Risk Management Skills and Capabilities Framework, August 2021 8 HM Government, The Orange Book: Management of Risk – Principles and Concepts, February 2020 9 Qq 49, 84–85 Government preparedness for the COVID-19 pandemic: lessons for government on risk 11 should focus on only at the start of a pandemic, following the establishment of its crisis response structures. Government officials told the NAO that a shared understanding of risk tolerance for many cross-government issues is still being developed.10 Communication of the main risks facing the UK Show less

The National Security Risk Assessment, which sets out government’s assessment of the main risks facing the UK and its interests overseas, is classified. Government has published a summary of this assessment and of the mitigations it has put in place … Read more The National Security Risk Assessment, which sets out government’s assessment of the main risks facing the UK and its interests overseas, is classified. Government has published a summary of this assessment and of the mitigations it has put in place every two or three years since 2008.11 The last edition of this public-facing National Risk Register was published in December 2020.12 The Cabinet Office acknowledged that government has a chequered history in communicating risks to the public and stated that government’s messaging on risks should be more balanced, accessible to non-experts and lend itself to practical actions.13 It noted that clearer public communication of risks would help people make evidence-based choices on how to prepare for the impacts of risk events. It would also support government’s goal of engaging the wider population in government’s “judgments about what is an acceptable level of risk and what is the correct level of investment to prevent those risks in the future”. The Cabinet Office stated that clearer communication of risk is one of the foundational principles of the government’s resilience strategy, which had over one million different interactions and is due to be published in 2022.14 Show less

It was reported in September 2021 that the Health and Safety Executive had been notified of 103 instances of serious laboratory leaks, including nine in the most secure level-4 laboratories.15 Lack of transparency to the public about these leaks has … Read more It was reported in September 2021 that the Health and Safety Executive had been notified of 103 instances of serious laboratory leaks, including nine in the most secure level-4 laboratories.15 Lack of transparency to the public about these leaks has hindered public discussion on balancing the benefits of scientific research with the risks of infection to the public. The Cabinet Office stated that the updated biological security strategy, which is due to be published in 2022, will address laboratory security.16 Show less

We raised the question of whether individual members of the Scientific Advisory Group for Emergencies (SAGE) should be allowed to make public statements that are inconsistent with the collective messaging of the Group. When asked if refraining from making such … Read more We raised the question of whether individual members of the Scientific Advisory Group for Emergencies (SAGE) should be allowed to make public statements that are inconsistent with the collective messaging of the Group. When asked if refraining from making such statements should be a condition for joining SAGE, the Department expressed concern that this might restrict the range of experts who would be willing to join the group and increase the risk of groupthink.17 The Chief Scientific Adviser and Chief Medical Officer subsequently told us in written evidence that they would regard this as a damaging and unhelpful restriction on the academic independence of individual scientists. They noted that, while the research and interpretations of individual scientists should not be excluded from the media, it is important that they make it clear when they are speaking as individuals, as opposed to members of SAGE.18 10 C&AG’s Report, para. 3.7; Q 31 11 C&AG’s Report, para 1.4 12 HM Government, National Risk Register: 2020 edition, December 2020 13 Q 67 14 Q 66 15 Rhys Blakely, “Safety breaches investigated at UK labs that deal with deadly viruses”, The Times, 17 September 2021 16 Q 48 17 Qq 33–34 18 Letter from the Government Office for Science and the Department of Health & Social Care, 27 January 2022 12 Government preparedness for the COVID-19 pandemic: lessons for government on risk International collaboration Show less

The Cabinet Office acknowledged the need for international co-operation to assess threats, manage risks and share information. As examples of the UK’s engagement, they mentioned work carried out with the World Health Organisation (WHO) in response to Ebola; the Carbis … Read more The Cabinet Office acknowledged the need for international co-operation to assess threats, manage risks and share information. As examples of the UK’s engagement, they mentioned work carried out with the World Health Organisation (WHO) in response to Ebola; the Carbis Bay Declaration, issued in July 2021, which commits G7 countries to share results from vaccine and therapeutic trials to tackle COVID-19 and prevent future health threats; the commitment of governments and life science industry, following a discussions at a UK-hosted G7 Health Ministers’ meeting in June 2021, to reduce the time to develop diagnostics, vaccines and treatments to 100 days after a new pandemic threat is identified; and the UK’s role as host of the 2021 United Nations Climate Change Conference (COP26).19 Show less

The Cabinet Office recognised that the UK needs to further strengthen international cooperation and noted that this will be a central feature of the UK resilience strategy. The Department stated that the UK is seeking a new pandemic treaty through … Read more The Cabinet Office recognised that the UK needs to further strengthen international cooperation and noted that this will be a central feature of the UK resilience strategy. The Department stated that the UK is seeking a new pandemic treaty through the WHO that would place greater obligations on countries and that it would welcome the introduction of an early international alert level, prior to the declaration of a Public Health Emergency of International Concern.20 To foster public debate on existential risks to the whole of mankind, which cannot be mitigated by nations individually but require a long-term, concerted international effort, the Cabinet Office stated that it is considering including a commentary on existential risks in the next edition of the National Risk Register. The Cabinet Office pointed to efforts to tackle climate change and to regulatory work on general- purpose artificial intelligence as examples of work being carried out internationally on specific existential risks.21 Show less

Alongside greater international cooperation, the Cabinet Office noted the need to strengthen domestic collaboration on risks, especially with the private sector. The Cabinet Office stated that government is considering requiring regulated companies and those that have significant dealings with government … Read more Alongside greater international cooperation, the Cabinet Office noted the need to strengthen domestic collaboration on risks, especially with the private sector. The Cabinet Office stated that government is considering requiring regulated companies and those that have significant dealings with government to comply with resilience standards, and enhancing its communication to the wider private sector about risks, such those arising from just-in-time procurement.22 19 Qq 53, 62–63 20 Q54 21 Qq 51–52 22 Q 99 Government preparedness for the COVID-19 pandemic: lessons for government on risk 13 2 Lessons on pandemic preparedness Learning from incidents and simulation exercises Show less

Government lacked detailed plans for several aspects of the response to COVID-19, including financial support to local authorities, identifying a large population advised to shield, and economic support schemes.23 A submission we received from an academic research group studying the … Read more Government lacked detailed plans for several aspects of the response to COVID-19, including financial support to local authorities, identifying a large population advised to shield, and economic support schemes.23 A submission we received from an academic research group studying the issues concerning the early childhood education and care sector arising from the government’s initial pandemic response stated that preparedness for enabling that sector to switch into crisis mode in advance of the pandemic was generally poor.24 The Senior Responsible Owner for Universal Credit has stated that government had not made specific plans for unemployment surges colliding with a pandemic.25 Show less

The Cabinet Office attributed the absence of detailed planning for a pandemic like COVID-19 to the fact that they did not anticipate a disease with asymptomatic transmission which required an extended lockdown.26 Yet, a large-scale infection with widespread asymptomatic transmission … Read more The Cabinet Office attributed the absence of detailed planning for a pandemic like COVID-19 to the fact that they did not anticipate a disease with asymptomatic transmission which required an extended lockdown.26 Yet, a large-scale infection with widespread asymptomatic transmission was not unprecedented. The early spread of HIV, too, was partly caused by the fact that it was an asymptomatic condition that could take months before being diagnosed. The Cabinet Office and the Department recognised that government needs to set out risks more broadly and be prepared for a wider range of manifestations of any given risk.27 Show less

While government took action following major pandemic simulation exercises such as Cygnus and Winter Willow, it did not act upon some of the warnings about the UK’s lack of preparedness from these simulations. For instance, at the outset of the … Read more While government took action following major pandemic simulation exercises such as Cygnus and Winter Willow, it did not act upon some of the warnings about the UK’s lack of preparedness from these simulations. For instance, at the outset of the COVID-19 pandemic, many departmental business continuity plans lacked detailed arrangements for supplier assurance, despite the fact that following Winter Willow the government had noted the need for organisations to ensure that their business continuity plans were better coordinated with those of their partners.28 The Department recognised that government needed to embed lessons learned through a range of simulation exercises.29 Show less

The COVID-19 pandemic has shown the potential large-scale economic impact of a public health emergency requiring lockdowns and self-isolation. Yet, a submission that we received from academics working on lessons from loans to support businesses through Coronavirus noted that it … Read more The COVID-19 pandemic has shown the potential large-scale economic impact of a public health emergency requiring lockdowns and self-isolation. Yet, a submission that we received from academics working on lessons from loans to support businesses through Coronavirus noted that it is unclear whether government would be able to reinstate the scheme at short notice without the implementation issues experienced when it was first introduced.30 In January 2022, the NHS obtained a ministerial direction to enter into a contract for spare surge capacity with private sector health providers which, based on information available at the time of our session, will cost at least £75 million a month. During the session we noted that, had government embedded learning about planning from the early COVID-19 response, that contract might have been cheaper and might have 23 C&AG’s Report, paras 3.12 & 3.19–3.20 24 Dr Kate Hardy, Dr Xanthe Whittaker, Dr Nathan Archer, Dr Helen Norman, Dr Jennifer Tomlinson and Dr Katie Cruz (Ev TRE0007) 25 Statement by Neil Couling at the webinar The safety net in action? Universal Credit’s role in the crisis and the recovery, 27 May 2020, available at https://www.youtube.com/watch?v=O0QTmqX0kkM, from 22’53’’ to 23’18’’ 26 Q 43 27 Qq 38–42 28 C&AG’s Report, para. 3.20 29 Q 40 30 Dr Christoph Görtz, Prof. Danny McGowan and Dr Mallory Yeromonahos (Ev TRE0001) 14 Government preparedness for the COVID-19 pandemic: lessons for government on risk not required a ministerial direction.31 We queried what percentage of NHS consultants also work for private sector health providers. The Department told us in written evidence that, based on a commercial report, about 20% of UK specialists work in private practice, and 2% work exclusively in private practice. Reports from private providers suggest that many consultants devote a small proportion of their total working time to private work and contractual provisions include that their work must not diminish the public res Show less

We have repeatedly highlighted longstanding issues with the quality of data held by government and with its ability to use data effectively to support policy interventions. Our 2019 report Challenges in using data across government noted the lack of government-wide … Read more We have repeatedly highlighted longstanding issues with the quality of data held by government and with its ability to use data effectively to support policy interventions. Our 2019 report Challenges in using data across government noted the lack of government-wide data standards, ageing IT systems, fragmented leadership and a civil service culture that does not support sharing data across departmental boundaries. For instance, the contact centre that government set up a part of its programme to support those most vulnerable during the first lockdown could not get in touch with around 800,000 individuals due to missing or inaccurate NHS records. As we noted in our 2021 report Challenges in implementing digital change, scarcity of specialist digital, data and technology skills across the public and private sectors and a lack of digital skills among government’s senior non-specialists limit government’s ability to address these issues.33 Show less

Insufficient progress made on data issues over the years has hindered government’s initial pandemic response. For instance, local government initially lacked access to information from NHS Test and Trace that they needed to deliver their local pandemic response.34 A submission … Read more Insufficient progress made on data issues over the years has hindered government’s initial pandemic response. For instance, local government initially lacked access to information from NHS Test and Trace that they needed to deliver their local pandemic response.34 A submission from the International Longevity Centre UK noted that, despite successive promises from the government, “there has been a lack of coordinated information recording and record sharing between health professionals. The government has built an expansive data infrastructure to respond to the COVID-19 pandemic, but had to do so almost from scratch when it should have already existed”.35 Show less

The Cabinet Office noted that, in 2021, government set up a National Situation Centre which will provide real-time access to data government needs to respond to the emergencies set out in the National Security Risk Assessment. The Cabinet Office hopes … Read more The Cabinet Office noted that, in 2021, government set up a National Situation Centre which will provide real-time access to data government needs to respond to the emergencies set out in the National Security Risk Assessment. The Cabinet Office hopes that this will significantly enhance emergency response as it will no longer have to collect and aggregate data from scratch when a new crisis begins. While this initiative is laudable, it will bring limited benefits if the quality of the data collected remains low.36 Show less

The Department stated that, while government’s access to data from the social care system has greatly improved during the pandemic, it is likely that this access will be somewhat scaled down as the emergency subsides. It told us that this … Read more The Department stated that, while government’s access to data from the social care system has greatly improved during the pandemic, it is likely that this access will be somewhat scaled down as the emergency subsides. It told us that this is because providing 31 Qq 12–27 32 Q 24; letter from the Department of Health & Social Care, 27 January 2022 33 Committee of Public Accounts, Challenges in using data across government, 118th Report of Session 2017–19, HC 2492, 25 September 2019; and Committee of Public Accounts, Challenges in implementing digital change, 30th Report of Session 2021–22, HC 637, 10 December 2021 34 C&AG’s Report, The government’s approach to test and trace in England – interim report, Session 2019–20, HC 1070, 11 December 2020, para. 23 35 International Longevity Centre UK (Ev TRE0002) 36 Qq 103–106 Government preparedness for the COVID-19 pandemic: lessons for government on risk 15 data to government comes at a significant cost to the small- and medium-scale private businesses that make up a large part of the social care system, and a balance should be sought between sector resilience and the burden on businesses.37 37 Q 109 16 Government preparedness for the COVID-19 pandemic: lessons for government on risk Show less