Independent IT review
Downloads
2. Where are we now?
2.1. Headline statement
The headline statement taken from the initial findings of a lessons learned review carried out by the CQC Portfolio Management Office (PMO) report [ii] states: “The Transformation Portfolio has resulted in an incomplete implementation of a new organisation and business process which is ineffectively supported by the IT systems”. This concept, and in particular the order of these statements will be explored in the paragraphs that follow.
2.2. Costs
An excerpt (Figure 1) from the Audit Risk and Assurance Committee (ARAC) presentation in Sep 2024 shows the financial profile of the Regulatory Transformation (RT) Programme from the inception (Strategic Outline Case (SOC) Nov 2019) to July 2024. The actual spend to date (Dec 2024) is £99M.
This shows the programme Whole Life Costs (WLC) rising from £28.4M, over 5 years, to £145.5M, over 10 years in line with the expansion of scope. The Net Present Value (NPV) has remained negative throughout the various resets over the last 5 years.
The following table shows the transition of the programme over time:
Programme (£m) | November 2019 | April 2020 | April 2023 | October 2023** | June 2024 | July 2024 |
---|---|---|---|---|---|---|
Title | Regulatory Platform Strategic Outline Case | Regulatory Platform Outline Business Case | Regulatory Transformation Programme Business Case | Regulatory Transformation Change Request | Regulatory Transformation Update | Regulatory Transformation Update |
Benefits Period | 5 Years | 5 years | 10 years | 10 years | 10 years | 10 years |
Implementation Costs | 28.4 | 16.0 | 84.1 | 91.7 | 97.3 | 99.0 |
Post Implementation Costs | - | 28.2 | 47.7 | 47.7 | 47.7 | 46.5 |
Whole Life Cost (WLC) | 28.4 | 44.2 | 131.8 | 139.4 | 145.0 | 145.5 |
Decommissioning Benefits | 4.1 | 17.8 | 46.1 | 40.0 | 40.0 | 40.0 |
Staff Efficiency Benefits | 28.4* | 23.4 | 76.8 | 77.1 | 77.1 | 74.3 |
Total Benefits | 32.5 | 41.2 | 122.9 | 117.1 | 117.1 | 114.3 |
NCF | -24.3 | -3.0 | -8.9 | -22.3 | -27.9 | -31.1 |
NPV | -27.9 | -20 | -9.8 | -20.4 | -24.7 | -26.2 |
Scope | Replacement of core business systems | Replacement of core business systems | Technical change, new regulatory model, SAF, process change*** | Technical change, new regulatory model, SAF, process change, ICS/LAA, Other Services*** | Technical change, new regulatory model, SAF, process change, ICS/LAA, Other ServiceS***/**** | Technical change, new regulatory model, SAF, process change, ICS/LAA, Other ServiceS***/**** |
*Non-Cash Releasing
**The change request with NCF and NPV was presented in March 2024
***See following slide for services in scope
****Includes costs of 2024/2025 investment relating to decommissioning CRM and data archiving, deferred Registration and Enforcement functionality, website publications, and integration software
Figure 1: excerpt from ARAC presentation re RT spend profile overtime
2.3. Functional analysis
Drawing on another PMO internal review [iii], Figure 2 shows a simple summary of the status of the RP deliverables that were established in 2023 following the signoff of the Full Business Case (FBC). The review was undertaken in Oct 2024 by the PMO. It reflects the original scope of the programme (as at 2023) following which various deliverables were descoped with the agreement of the Programme Board. This provides a simplistic analysis as each requirement may be very different in terms of scale, but it does provide a useful summary of the overall status.
Delivery area | 2023 Deliverables - Service / Data | Number Believed Descoped / Not Delivered |
---|---|---|
Registration | 23 items | 7 delivered (30%) 16 Not delivered (70%) |
Assessment | 13 items | 2 delivered (15%) 11 Not delivered (85%) |
Enforcement | 22 items | 8 delivered (36%) 14 Not delivered (64%) |
Reg Leadership | 14 items | 0 delivered (0%) 14 Not Delivered (100%) |
Fees Calculator | 4 items | 1 delivered (25%) 3 Not Delivered (75%) |
Reg Governance | ||
Outreach | 11 items | 0 delivered (0%) 11 Not Delivered (100%) |
Oversight | 23 items | 4 delivered (31%) 9 Not delivered (43%) |
Notifications & Contact | 20 items | 14 delivered (70%) 6 Not delivered (30%) |
Overall items reviewed | 130 items | 36 delivered (28%) 94 Not delivered (72%) |
Figure 2: Summary of deliverables of the RT programme as of Oct 2024.
As the table shows, less than 30% of the deliverables that were established in the April 2023 FBC have been signed off by the organisation. There is a significant variation between the achievement of deliverables within each area ranging from 0% (Outreach) to 70% (Notifications and Contact). A couple of areas are worth considering in more depth:
Assessment: Interviewees for this IIR surfaced dozens of functionality issues with the RP Assessment app - one colleague took the time to document 47 concerns (appendix 15). Having seen the Assessment App in use, it is clear that it is overcomplicated and a significant proportion of the functionality adds no value, for example the App requires users to upload every piece of evidence and tag it to an Evidence Category (EC), then to add a validation remark against each copy and paste every piece of commentary that already exists in a templated Word document to a different screen of the App. This takes the user hours (even after a fix to increase the Apps speed) and adds no additional value beyond that contained in the Word document.
Notifications: the intention of the RT programme was to achieve 80% of Notifications via the Provider Portal. Currently, 35% come through this route, with the remaining using the “off platform” method of downloaded Word templates and emails. Providers are using out of date versions of these templates and also printed, handwritten and scanned forms (which are then emailed). It is currently permissible for providers to aggregate more than one Notification into one email attachment.
Across the whole RP there are process and technical “gaps” that have to be filled by non-intuitive manual workarounds, with the risk that these are forgotten with unintended consequences as this quote illustrates:
For sectors other than ASC, you must manually update the view every time a new service is registered and added to Reg Platform. This relies on individuals remembering to do this.
The internal IT department has recognised that Registration, Assessment and Notifications are in urgent need of reworking from a Functional, Technical and Data point of view.
2.4. Benefits achieved
The PMO review has also considered the detailed benefits (that form the benefits register (n=62)) which were aligned with the Strategic Benefits signalled in the 2023 FBC, shown in Figure 3 below.
Strategic Benefit (Here) | Benefits Aligned | # Validated & Closed | # In Review - May deliver on benefit | # Still in Work to Realise | Descoped / Withdrawn Benefits |
---|---|---|---|---|---|
B1. People experience reduced health inequalities – related to a) access; b) experiences; c) health and care outcomes. | 4 | 0 | 2 | 2 | |
B2. People have better information about the quality of health and social care services leading to more informed choices. | 5 | 1 | 1 | 2 | 1 |
B3. More people experience health and care provision that is driven by what matters to them. | 1 | 0 | 0 | 1 | |
B4. Improvement in the quality of care for people. | 7 | 0 | 0 | 5 | 1 |
B5. Increased productivity and efficiency of CQC. | 34 | 2 | 9 | 23 | |
B6. Providers and systems experience reduced regulatory burden. | 4 | 0 | 3 | 0 | 1 |
B7. Improvement in the safety of care for people. | 5 | 0 | 2 | 1 | 2 |
B8. Services and systems can provide more efficient, effective, and sustainable care. | 0 | 0 | 0 | 0 | |
B9. People providers and stakeholders have an improved experience of CQC services. | 2 | 0 | 0 | 2 | |
62 | 3 | 17 | 36 | 5 | |
5% | 27% | 58% | 8% |
Figure 3: Benefits analysis of the RT Programme, Oct 2024
As the table shows only 5% of the benefits have been achieved. A further 27% of the aspired benefits are in some type of Work in Progress status - i.e. there may be planned activity as part of a future phase or a fix has been delivered but not yet implemented, at the time of writing. At the time of writing there was no planned timeline to achieve 58% of the planned benefits and 8% have been descoped from the programme.
2.5. End user experience
2.5.1. The Ergonomics Review
The implementation of the RP has created a significantly negative response from users. Many awful stories were shared by individual users including descriptions of its impact on their physical and mental health, inability to perform their functions effectively and the frustration of raising concerns that they do not believe were listened to.
An independent review of the users’ experience has been undertaken, known as the Ergonomics Review (ER), which reported in Aug 2024. The ER summarizes the findings following a meeting with a selection of CQC users of the newly implemented RP. The users included Inspectors, Assessors, Regulatory Coordinators, and Operations Managers. The feedback and observation of the users undertaking activities on the system highlighted some significant concerns related to the functionality, usability, and impact of the new systems and the subsequent effect on the users’ mental and physical health.
It is recommended that this report is read in full (Appendix 5) as it would be unfair to summarise the detail and lose the essence of the messages it contains.
2.5.2. Health and Safety Survey
955 responses were gathered from a RP Health and Safety survey that managers were asked to conduct with each of the RP users in their teams during 2024. The headline news is shown in Figure 4:
Finding from H&S checklist | Number of colleagues | Percentage |
---|---|---|
No issues apparent at the moment | 362 out of 955 | 37.9% reported no issues |
Experiencing physical issues - See tab below for examples. | 80 out of 955 | 8% |
Reported their mental wellbeing is being affected - See tab below for examples | 199 out of 955 | 21% |
Reported that both their physical and mental wellbeing is affected | 314 out of 955 | 33% |
Number of colleagues not taking breaks | 231 out of 955 | 24% not taking breaks |
Figure 4: summary of the RP Health and Safety audit
The table shows that 62% of people surveyed reported that their physical health or their mental health or both were being affected by RP. There are examples of people having to take time off sick due to these physical and mental health concerns.
2.5.3. View of the trade unions
As part of this IIR, a meeting with the trade union representatives was held. They discussed RP’s painful implementation, lack of risk assessment, and failure to meet accessibility standards. Staff experienced stress and uncertainty due to poor communication and governance. The platform was not user-friendly, and frontline staff were not adequately involved in its development. These issues negatively impacted staff health and well-being.
A more detailed summary of the meeting with the unions can be found at Appendix 1.
2.5.4. IT Service Desk impact
There are some other summary statistics which provide a sense of the scale of the impact of RP on the end users:
Figure 5 shows the volume of calls to the IT Service Desk during the period of RP implementation phases.

Figure 5: IT service desk call volumes during RP implementation phases
Various points along the timeline are highlighted:
- The graph starts when the first module of RP was made live (Contact) in July 2023, showing a spike of 290 incidents for that week. This was largely due to users not having the correct permissions to access the system.
- 23 Oct 2023 shows another small peak as Notifications (second module) went live.
- 20 Nov 2023 to 11 Dec 2023 shows when the Assessment module went live, and call volumes have remained high since then.
- Go live 7 was governed by the RT Service Improvement Project and took place on 1 Oct 24. The service desk calls showed a spike of 414 incidents within one week with a significant number (n=41) that couldn’t be resolved within the week.
In total over 15,000 incidents have been reported to the IT Service Desk in relation to RP since July 2023. The vast majority (c 14,500) have been resolved.
Prior to the RP introduction the IT Service Desk would consider themselves to be busy with 20 incidents in the queue. There are currently (at the time of writing), 588 active RP incidents.
2.6. Some aspects of RP are working well
Positive comments were raised by members of the CQC’s National Customer Service Centre (NCSC) in relation to the Contact and Notification App, although, for balance the earlier point (section 2.3) should be noted about the low volume of Notifications coming through the PP.
- Improved data capture: The new platform allows for richer data capture, particularly in Notifications, which enhances the organization's ability to collect and utilize information effectively.
- Automation and efficiency: The new system has automated several manual processes, reducing the workload for staff and improving efficiency in handling customer service tasks.
- Enhanced visibility: There is better visibility of information and processes, which helps in tracking and managing tasks more effectively.
- Improved connections between data: The new system allows for better connections between different sets of data, which can lead to more informed decision-making and improved overall functionality.
- Managing Cases: Managing cases on RP works well - once the NCSC staff have added the initial information, the case is automatically saved under their location, and emails can be managed from within the platform and all such conversations are captured. This has saved a lot of time compared to the previous method.
An Operational lead referred to successes in the Assessment App for some simpler use cases:
- Transactional Tasks: The system works relatively well for small, frequent, and transactional tasks. For example, in the Nottingham Mental Health team, the system was used effectively for conducting small assessments frequently, which allowed for straightforward processing and reporting.
- Simple Processes: When the processes are simple and straightforward, the system can handle them efficiently. This includes tasks that do not require complex data analysis or extensive qualitative input.
- Integrated Teams: In some integrated teams, the use of the system has been more successful. These teams have managed to adapt their workflows to fit within the system's capabilities, leading to better outcomes.
It was also stated that the Enforcement aspect of RP works well, acknowledging that in comparison to other modules it is relatively straightforward.
2.7. Managing Data and Reporting
2.7.1. Intended architecture
Over the last 5 years CQC has been pursuing a data/reporting architecture for data to be collected in RP and then uploaded to the Enterprise Data Platform (EDP) from which reports could be run to meet corporate reporting and insight requirements, using Power BI. The legacy customer relationship management (CRM) system would be retired as would the historical data warehouses and data requiring a single version of the truth for insight or external reporting and higher level of scrutiny would be either pushed from RP to EDP or ingested directly into EDP from external sources e.g. national datasets (like Hospital Episode Statistics (HES) and national indicator sets (e.g. national clinical audits).
The creation of the EDP predated the RP programme as it was the output of the Transforming Data and Insight Programme (TDI). Although the programme was closed (end of 2022/23) it was not fully completed, as legacy systems had not been retired, but improvements to them renamed as deliverables of the programme. It was reported that some funding for the TDI programme was removed and the programme closed before it achieved all of its investment objectives as some deliverables (connecting RP to EDP) could not be completed at that time due to delays in the RT programme.
2.7.2. Practical difficulties for the analytical teams
The Insight teams, Performance Team and the Hub Team (hereafter analytical teams), responsible for providing analyst expertise, enabling Operations and other internal and external stakeholders to make best use of trusted data, are still having to rely legacy systems which is suboptimal, making the ingestion and manipulation of external data harder than it should be. Legacy systems are dislocated from EDP which necessitates lots of moving and shifting data from one place to another, and no implemented alternative solution for the ingestion of new external datasets and delivery of indicators at scale. EDP is not mature in terms of having all the pipelines it needs to the dataverse of RP, which necessitates some querying of the data lake copy of RP (accessing the raw data which is time consuming and prone to error).
The work to build pipelines that export and transform the data from RP to EDP has been successful (although incomplete), but slow and challenging due to the changing source data model, competing priorities and reliance on contingent labour and legacy proprietary frameworks. Also, it is not being seen as part of the responsibility of the programme/RP teams to ensure the data is safely delivered to EDP for onward use/reporting. Currently 13 RP modules of the 23 have completed pipelines (56%). Funding has not been made available to complete the remaining 10 modules and governance is very siloed and difficult. These concerns have been partially documented as part of the Silver recovery work.
The CQC has been without a clean end to end vision to guide the delivery of changing services which has affected the data it uses to make regulatory decisions and data it publishes externally.
The Registration service has gone back to the legacy CRM system so that is another data source to query. Taking data from multiple sources increases the chances of error and can reduce its reliability. Data must be synchronised between the legacy CRM and RP, but data models and processes differ between the two systems, so this is difficult, and more gaps and errors and their practical consequences are being identified on an ongoing basis.
The analyst teams need to manually verify the data extracted from the system to ensure their accuracy. This involves cross-checking data against other sources and validating their reliability which is very time-consuming. Analyst teams have to work around the misaligned data models, which are not fully aligned with the emerging business processes. This requires additional effort to interpret and adjust the data for reporting purposes.
There is a large backlog of required changes to RP to resolve data quality and data extraction problems and these changes are competing with other higher priority items. The team have to rely on manual processes to access external data sources (e.g. downloading data from the Model Hospital) to supplement the lack of data in the EDP and some key data sources (e.g. mental health outcomes) are now over 2 years out of date as there have been problems trying to refresh them. In addition, it is challenging to access qualitative data (such as via Notifications etc).
The patient data sources are still coming through the legacy database which is slow and antiquated and can’t be meaningfully changed. These pipelines need to be rebuilt on EDP, or alternative methods found (these are under investigation).
In addition to reporting requirements the data quality in some areas requires improvement. The user journeys through RP are overly complicated and the system doesn’t allow users to go back and forth to correct things, which also affects data quality.
Data validation (at the point of entry) is insufficient, and business processes are unclear which causes a large number of blank or duplicate records e.g. operational staff can create a new contact rather than finding an existing record because it takes too long or the process is not clear, leading to duplicates and a fragmentation of the client’s history.
The many workarounds and off platform alternatives that have emerged to obviate the poor user experience of RP exacerbate data quality problems and increase operational risk. There are basic risks of sending the wrong information to the wrong customer/client. It is understood anecdotally that colleagues are sending emails to addresses that aren't from the central RP system as they hold different information personally (e.g. in off platform address books). This risks an Information Governance breach.
2.7.3. Practical implications for operations
These data quality, extraction and reporting problems coupled with hybrid working arrangements and other workarounds (e.g. using legacy MS Word forms) inhibits the management of the CQC Operations teams in being able to oversee regulatory risk and achieve the transformational ambition to be data led and responsive to risk rather than inspect on a timeline basis. Performance management difficulties raised by the operations leads include being unable to have analytical reports that provide oversight of the integrity of the following types of functions:
Information of Concern: The organization needs to capture and process information of concern, such as safeguarding issues or abuse reports, and ensure timely referrals to local authorities.
Statutory Notifications: These include various mandatory reports that need to be processed and tracked, often in large volumes.
Inspection Activity: The organization must track and report on the amount and nature of inspection activities to ensure compliance and accountability.
Regulatory judgements: The organization needs to integrate various data sources, including metrics about the quality of care, to build a comprehensive picture of risk and quality for regulatory judgments.
2.8. Formally approved workarounds
Due to the difficulties with RP two formally approved workarounds have been launched.
The Hybrid Approach (HA) has been deployed for assessments for Adult Social Care (ASC) and Primary Medical Services (PMS) in which some functions are performed off platform, using MS Office files -e.g. One Note documents, MS Excel spreadsheets and MS Word, some functions are carried out in RP (e.g. Contact, Notifications, Second Opinion Appointed Doctor).
For hospital services another approach has been in deployment (partly built but in operational use) from 2 Dec 2024, referred to as the Off Platform Location Assessment Plan (LAP) process. This is a simplified approach to handling hospital inspections, which starts with one system to organise resources, then a shell is created in RP to indicate the hospital and the Quality Statements (QS) to be inspected. The actual inspection is conducted, and evidence is gathered, following which the report is written in a Word document template, rather than directly in the RP. All documents, plans, and drafts are saved into a case in the RP, linked to the assessment plan. Quality assurance (QA) is done in Word, through peer review and QA processes. The final report is then copied and pasted into a simple publishing tool, to create a PDF that is sent to the provider via email. Providers are given a factual accuracy form, which could be web-based or a Word document, to provide feedback. The feedback is processed, and the final report is checked again and sent back to the provider. The final report is published by linking the publishing tool with the RP, allowing the report to be lifted and published as a PDF onto the website. The technical work to enable this final step of the process is planned for completion by end Jan 2025.
The extent to which these workarounds have been documented and staff made aware/trained so that they represent “standard work” is not clear.
2.9. Reverting to the legacy CRM
As a result of the poor user experience, the Registration function has now reverted to using its legacy CRM solution. Leaving aside the risk that this poses relating to the age/stability of this system there are other major challenges of using the legacy CRM system for part of the CQCs core process.
Notes
ii Transformation Portfolio Lessons-Learned_V0.1 (DS)
iii Excerpt of RT delivery analysis (DS)