An "under-planned and underfunded" IT upgrade delayed national security vetting and is costing about £17m a year in inefficiencies, according to the UK government's spending watchdog.

The National Audit Office carried out an investigation into national security vetting after complaints of severe delays to the process, which considers applications for access to government information, locations or equipment.

In January 2017, the two bodies tasked with managing the applications were merged into one, UK Security Vetting (UKSV) – but for the next 15 months, the two sites effectively continued to operate separately.

At the same time, there were complaints that applications – from civil servants, contractors and specialists – were delayed. For one of the three main types of checks, targets will not be met until December.

The NAO warned of the danger of delays in vetting when the government is handling not only high-profile projects like Brexit, but also an increased threat of terrorism.

The Cabinet Office has estimated the delays have caused inefficiencies that cost UKSV customers £17m a year.

'Under-resourced, under-planned and underfunded'

One of the main problems highlighted in the report was the implementation of an IT system, the National Security Vetting Solution, that went ahead despite a warning from the programme board that it was "under-resourced, under-planned and underfunded".

The plan was to create a single system for handling applications, and it should have been implemented on both of the two former sites before the merger.

However, in the first week after one of the sites, Defence Business Services National Security Vetting, upgraded – at a cost of £14m in October 2016 – 10 of 13 essential functions didn't work properly.

"At one point following its introduction, nearly 8,500 files containing personal data were unreadable and 93 per cent of automated checks against the police national computer failed," the NAO said.

"Officials had to re-process failed checks manually, reload files and recover data, and conduct additional assurance checks."

'Merged' bodies operated exactly as before – for 15 months

In light of this, the other site delayed implementation until November 2017, and relied on existing paper-based systems up to April.

The result was that the services and performance targets across the two sites weren't fully aligned for 15 months after the merger.

Effectively, the NAO said, before April 2018 "each site was delivering its existing products to existing customers, and measuring and reporting performance as it had done before the merger".

Even now, the Cabinet Office believes the IT system is experiencing issues with speed, and began developing a replacement in May that should be in place by January 2020.

The NAO also identified problems with staffing: although an internal assessment said the UKSV needed 595 bodies, there have never been more than 507. And a spate of resignations left the UKSV reliant on overtime, agency and contractors.

Overall, staff costs were £19m in 2017-18, which is 17 per cent more than the combined costs for the two previous bodies in 2014-15.

"Considering the pressures facing government, the last thing we need is a non-functioning vetting system," said NAO boss Amyas Morse.

"An effective system needs to be put in place urgently to ensure the government is able to use its staff effectively, giving them access to the right information, locations and equipment." ®