SCOTS Project - www.scottishcorpus.ac.uk

Document : 1104
Title    : Scottish Parliament: Committees: Audit: Official Reports:
Meeting 8, 1999
Author(s): Scottish Parliamentary Corporate Body

Copyright holder(s): Scottish Parliamentary Corporate Body: © Scottish
Parliamentary copyright material is reproduced with the permission of the
Queen's Printer for Scotland on behalf of the Scottish Parliamentary
Corporate Body.

Text

Session 1 (1999) 
Scottish Parliament
Audit Committee
Official Report 
Meeting No 8, 1999 

--------------------------------------------------------------------------------
 
23 November 1999 



CONTENTS

Tuesday 23 November 1999


AUDIT COMMITTEE 8TH MEETING 
    
"THE MILLENNIUM THREAT: IS SCOTLAND READY?" 


AUDIT COMMITTEE
8th Meeting

CONVENER:

*Mr Andrew Welsh (Angus) (SNP)

COMMITTEE MEMBERS:

*Brian Adam (North-East Scotland) (SNP)
*Scott Barrie (Dunfermline West) (Lab)
*Cathie Craigie (Cumbernauld and Kilsyth) (Lab)
*Miss Annabel Goldie (West of Scotland) (Con)
*Margaret Jamieson (Kilmarnock and Loudoun) (Lab)
*Mr Nick Johnston (Mid Scotland and Fife) (Con)
*Lewis Macdonald (Aberdeen Central) (Lab)
*Paul Martin (Glasgow Springburn) (Lab)
*Euan Robson (Roxburgh and Berwickshire) (LD)
Andrew Wilson (Central Scotland) (SNP)

*attended

WITNESSES:

Muir Russell (Permanent Secretary, Scottish Executive)
Craig Russell (Year 2000 Project Manager, Scottish Executive)

COMMITTEE CLERK:

Sarah Davidson

SENIOR ASSISTANT CLERK:

Shelagh McKinlay

ASSISTANT CLERK:

Alastair Macfie
 
--------------------------------------------------------------------------------
 
23 November 1999 



Scottish Parliament

Audit Committee

Tuesday 23 November 1999

(Afternoon)

[THE CONVENER opened the public meeting at 13:48]

"The Millennium Threat: Is Scotland Ready?"

The Convener (Mr Andrew Welsh): I welcome everybody to today's meeting.
There is one apology, from Andrew Wilson.

Today, we are considering the millennium threat, and asking, "Is Scotland
ready?" Mr Muir Russell, permanent secretary of the Scottish Executive, is
our main witness today and the principal accounting officer. I welcome you,
Mr Russell, and ask you to introduce your colleague to the committee.

Muir Russell (Permanent Secretary, Scottish Executive): Thank you for your
welcome, convener. My colleague is Mr Craig Russell—no relation. He is
the team leader and has overall responsibility in the Scottish Executive
for the year 2000 project.

The Convener: I welcome you both. I remind members that questions should be
put directly to Mr Muir Russell, who will invite Mr Craig Russell to
respond where appropriate. I hope that there is no confusion.

Muir Russell: We will do our best.

The Convener: Members of the committee will want to question Muir Russell
in detail on the major themes of this report from the Comptroller and
Auditor General, "The Millennium Threat: Is Scotland Ready?" At the end of
the meeting, there will be an open session during which members may ask
follow-up questions that come to mind.

I would like to begin with some general questions to set the context for
today's evidence-taking session. What would have happened if the state of
year 2000 readiness described in the report had not been reached? In other
words, how urgent and important was your work?

Muir Russell: It was clearly urgent and important. Those who have seen some
of the speculation on what can go wrong—stories that have been rather
alarmist—can draw their own conclusions about what might have gone wrong.

 
We have worked through the systems in the Executive and through the
infrastructure systems to track down all the things that might have gone
wrong, to see for ourselves that go right. I do not want to offer a
catalogue of possible disasters such as the non-payment of pay or subsidies
or pensions, but those areas were our highest priorities.

The Convener: Will you be travelling abroad over Christmas and new year?
Would you say that no one need have qualms about doing so: aircraft will
not fall out of the sky, ships sinks or trains come to a halt?

Muir Russell: I have no wish to send anyone away from this committee with
the impression that any of those things will happen, but my own hogmanay
plans are more prosaic. I will be in what the parliamentary debate called
the bunker, that is, in St Andrew's House, where the information liaison
centre will be operating and people will be on duty in the emergency room.
That is not to say that we are expecting problems, but we are being prudent
and, given my accounting officer responsibilities, it seems sensible for me
to be there, to make the coffee or whatever.

The Convener: Moving from speculation to reality, will you describe the
ways in which Scotland will actually be affected by the year 2000 date
change problem?

Muir Russell: I take the report at face value. We have tried to track down
the areas where systems might have gone wrong and to get them fixed, moving
from the critical to the non-critical, looking at the embedded chips and so
on and then at the millennium operating regimes and contingency plans. I
take comfort from the report; it is about the infrastructure and that has
been pretty well chased down. I do not think that major things will go
wrong.

One imagines that there will be bits and pieces in the parts of life that
are not covered by the report that go wrong. Some of the literature that
has gone out to the public has included things like how to check their
video recorder. There may be a few people who do not manage to video the
modern equivalent of Andy Stewart. I am not envisaging something disastrous
happening. The preparations that have been made give those of us involved
in that process a degree of comfort that it has been a pretty thorough
job.

The Convener: The vast majority of businesses in Scotland are small and
medium enterprises. They supply to larger organisations and may be crucial
to their operations. On page 26 of the report, you point out that over a
third of such small businesses have an identifiable risk. Could that be an
Achilles heel for large organisations that are otherwise on target for the
millennium? What is the identifiable risk and what is being done about it?

Muir Russell: You are right to point out that this report, and a picture of
reality, give less comfort about the small business end of the supply
chain. Bigger firms have checked through their supply chains and have
proactively gone to the small and medium firms that are their suppliers.
Therefore, there has been quite a bit of checking from the top end of those
supply chains. Certainly, the public sector has done that, as have most of
the infrastructure people.

The critical factors that would cause the problem of SMEs to manifest
itself as a supply chain collapse have been dealt with. Recently, I read a
statement from a big company in Scotland, British Energy, which said:

"We have been in discussions with all our key suppliers to satisfy
ourselves that their Year 2000 programmes are robust and on track, and that
. . . they are addressing the services which they provide to British
Energy. Any difficulties identified have been addressed with the other
party, and there are no outstanding issues."

That is just one example, but it is typical of what a lot of big firms will
have done. Without wishing to argue with the proposition that is in that
paragraph, in supply chain terms a lot of that has been addressed.

More generally, we recognise that, as the survey shows, the small business
sector still needs to do some work. Throughout this exercise Action 2000
has had the main responsibility for energising the private sector to play
its part. It has issued a lot of information and helpful guidance. Craig
Russell and his colleagues have involved the private sector in the various
conferences and infrastructure forums that have been held to get the
message across.

Training and information have been provided through the Scottish Executive
and the local enterprise company network, and ministers have given
encouragement whenever they have had the opportunity. For example, at the
end of his statement on 11 November, Henry McLeish emphasised once again
the importance, even at this stage, of addressing this issue. A lot of
pressure has been put on small businesses, and a lot of help has been given
to them. I suggest that the supply chain worry has been looked after to a
large degree.

The Convener: You will understand that the worry is that a small part can
cause a large machine to come to a grinding halt—for want of a nail a
shoe was lost, and so on. Paragraph 3.27 on page 31 points out that 45 per
cent of suppliers to Government and Government agencies did not provide Y2K
assurance. It adds that:

"Concrete proof of readiness was lower with no evidence being supplied in
most of the cases."

How much of a problem is that?

Muir Russell: Chasing the problem down has been a continuous piece of work.
Both before and since the report was written, our purchasing people have
been in touch with a wide range of our suppliers to check up on them in the
same way as I have described the private sector doing. We are on the case
and are attempting to get as much assurance as possible about our supply
chains.

The Convener: Before opening up this issue to the committee, I have a
final, general question. Are there elements of the preparations to counter
the millennium threat in Scotland that could have been better? How could
you have improved what has been done?

Muir Russell: You will trap me into sounding very smug.

The Convener: That could be dangerous.

Muir Russell: I am sure that we could have found ways of doing things
earlier, or more quickly or cheaply, or that we could have involved more
people. I am sure that, with hindsight, something will be spotted. However,
the whole construct has been to scope what constitutes the infrastructure
and the processes, to find the people who drive the things through and to
go on to the stage of independent assessment that comes through in the
report. I do not think that I would want to change any of that. With only
40 or so days to go, we have been able to produce a report that covers the
ground very well. That suggests that the basic framework has been about
right in terms of content and timing.

The Convener: If, historically, the witness proves to have been
disastrously wrong, I guess the bunker is the best place to be.

Annabel Goldie wants to ask some questions on essential services.

Miss Annabel Goldie (West of Scotland) (Con): Mr Russell, I would like to
clear up one or two untidy wee odds and ends. Am I correct in saying that
Caledonian MacBrayne has now got a blue rating?

Muir Russell: Yes.

Miss Goldie: And Loganair?

Muir Russell: Yes. Information on them was coming through just as the
report was about to be published. In both cases, people were waiting for
the final assessment of contingency planning, and for one or two other
little checks. With CalMac, the whole problem was one winch on one vessel
that had to be checked, and that could not be done until the vessel was out
of service. That sort of detail held things up.

Miss Goldie: Why was the Loganair assessment not completed before the
national infrastructure forum meeting on 21 October?

14:00

Muir Russell: I think that Loganair had a slightly slower start to the
exercise. The introduction of the comprehensive approach started just a
little bit later for the islands airports than it did for some of the other
bits of infrastructure. There were a few discussions with Loganair about
whether it should be involved in that, and it was agreed that it should be.
It caught up fairly quickly, and the assessment was done, I think, on 2
November by AEA Technology. Quite a lot of the information that we have was
collected in August—Craig Russell will keep me right on that—so things
that happened a bit later are missing from the report.

Craig Russell (Scottish Executive Year 2000 Project Manager): It would be
fair to say that the work being done on both the national infrastructure
and the independent assessment increased as time went on. Certain things
came into the programme much later. It was easy to see that companies such
as British Energy should be included in an independent assessment; but
originally the view from the centre was that it was not necessary to
include small companies such as Loganair. That is why they came in later.
It was the Executive that pushed to have them included, because they were
lifeline services.

Miss Goldie: Are lighthouses covered in this National Audit Office report?

Muir Russell: I do not think so. I know that you raised that point on 11
November in Parliament, after which we took the trouble to check. There is
no problem. Lighthouses have been checked and are regarded as entirely
okay.

Miss Goldie: Mr McLeish was as relaxed as you are, but have we any
evidence?

Craig Russell: Yes, we do. After you raised the question, we wrote to the
Northern Lighthouse Board and sought direct assurances. We have since
received a letter confirming that the various elements of lighthouse safety
have been covered. That confirmation will be in the next statement that Mr
McLeish makes to MSPs, as will all the other positive assurances that we
have received in answer to questions raised in debate. We have received
positive assurance from the Northern Lighthouse Board that there is no
problem.

Miss Goldie: I would like to broaden and deepen this discussion, and ask
about the scope of the independent assessment of readiness for 2000. How
confident is the Executive that essential services will not be materially
disrupted?

Muir Russell: The target is no material disruption. We are confident that
all the processes have been gone through and that we will achieve that
target. That is what this whole process has been about: giving that degree
of confidence, by checking in all the ways that we have checked.

Given my exchanges with the convener, I am a little reluctant to offer an
absolute, 100 per cent, personal guarantee. However, we are getting as
close as we can to that, when a process such as this has been gone through
and checked by so many authoritative people at each different stage and at
each different level. If I sound cagey, it is because I am not in the
business of giving guarantees. However, I have given you my clear judgment,
based on what we have done, on what we know and on what we have seen from
all the auditing and checking that has been done.

Miss Goldie: I acknowledge what you are saying and fully understand the
reasons for your sensitivity, but can you be confident that the independent
assessments that have been commissioned by the Executive have been
undertaken to a common standard? They concern a very wide range of
organisations.

Muir Russell: The rules of engagement in the assessments have been driven
by central guidance and central protocols from Action 2000. A standard is
being applied across the UK.

A broad range of responsible, expert people is doing the assessment. They
were chosen as people who knew the sectors that they were going to examine.
For example, the Accounts Commission has been involved in local government.
Examining some of the operational sectors, the work has been done by major
engineering consultants, who have the appropriate familiarity with those
sectors.

The protocol—the handbook of things that need to be looked at—is always
there to back up the work at each stage, from the technical fixes through
to the assessment of what the business is about, what might go wrong, how
to achieve continuity planning and which things to stop doing before
Christmas to avoid being at risk if anything should happen in one's own
area or elsewhere. All those layers of work have been set out and checked.

Miss Goldie: So you are satisfied that a common criterion has been
established by Action 2000 and that the various satisfying authorities have
complied with that?

Muir Russell: Yes.

Miss Goldie: What about the wider sector? What information do you have on
assurances of no material disruption from Scottish organisations such as
Scottish Power?

Muir Russell: Those assurances have been checked as part of the power
generation section of the infrastructure system. It is subject to the same
audit procedure and protocols as any other power generating company.

Craig Russell: Unusually in this circumstance, I am a member of the
Scottish utilities forum, which brings together all main utilities
providers in Scotland. To refer back to one of your earlier questions, Miss
Goldie, as an ex-staff inspector, I have had the opportunity to look the
utilities providers straight in the eye and, as I said to them, to drink
deeply of their soul. To some extent, there has to be an element of trust
in all this. Engaging with the individuals and hearing openly and in a
closed group what they have to say, in a way which would not normally apply
for commercial organisations, tells us considerably more than what is put
into the public forum, and has given me considerable comfort over the past
year.

Like Muir, I would not wish to give an absolute guarantee, but we have gone
as far down that road as is reasonably possible.

Miss Goldie: I thank you, and hope that drinking deeply of their soul was
not too indigestible an experience for them.

With regard to the assurances that, I accept, both of you are giving to the
best of your knowledge and belief, what do you consider the remaining risks
to no material disruption over the millennium period? If you are aware of
any such risks, how are you addressing them?

Muir Russell: We do not know of any risks that we are planning for and have
not addressed; there is nothing that we know will go wrong and will have to
be dealt with. That is the short answer to your question. However, who
knows what will happen? The odd thing may turn up, and we will need to be
able to cope with it.

Many other things will be happening at the millennium. We need to
distinguish between conventional emergency preparation arrangements—this
event will be happening in the middle of winter and the middle of the night
and half a million people will be down the road enjoying themselves—and
liaison on the millennium bug.

Miss Goldie: The bunker will be an area of spartan, sterile abstinence.

Muir Russell: It will have to be, I am afraid. On our way here, we were
discussing whether there would be Irn-Bru or Eisberg.

The Convener: Nick Johnston would like you to consider the effect on
businesses.

Mr Nick Johnston (Mid Scotland and Fife) (Con): The convener has indicated
the main thrust of my question. I refer you to paragraph 3.15 on page 26,
which says that a third of businesses in the small and medium sector

"have an identifiable risk, but are not taking the full range of steps to
address Year 2000 issues."

Do you think that paragraph 3.15 gives an accurate picture of the steps
that the small and medium enterprises have taken towards Y2K compliance?

Muir Russell: I have no reason to challenge it. The figures come from
telephone interviews based on small samples, so one could argue about some
of the fluctuations from wave to wave. However, I have no basis for
challenging the statement to which you refer.

Mr Johnston: Do you have any further up-to-date information on the
situation of small businesses?

Muir Russell: Nothing that goes beyond the information contained in the
document, which was collected in September.

Mr Johnston: Can you quantify the risk to the economy and jobs in Scotland
of failures in this sector?

Muir Russell: I do not think that that has been quantified. The total
effect of the risks that have been identified is unclear. We have dealt at
some length with the supply chain interdependencies, but I cannot put a
figure on the investment and, consequently, jobs that will be affected.
Responsibility lies with the private sector. I have described the
responsibilities of Action 2000—the information, help and advice that it
has provided and the events that it has run. Those were designed to alert
the private sector to what it needs to think about and what it needs to do.
There comes a point at which the private sector has to make a judgment
about whether the problem is serious and where the balance of advantage
lies. We will have to wait and see what that judgment adds up to.

Because the survey information does not indicate 100 per cent preparedness,
people in my position and ministers have naturally been continuing to
emphasise and support Action 2000's efforts to improve the figure. However,
people out there have to listen to those messages and do something about
the problem

The Convener: You said that this was a small sample. For the record, could
you say how many companies were included in it?

Muir Russell: A few hundred companies out of 300,000 SMEs will have
responded. I am not saying that sampling techniques have not been properly
worked out, but there have been fluctuations of a few percentage points
here or there, which means that the real figure might be anywhere between
65 and 70 per cent.

Mr Johnston: Do you think that, even at this late stage, it would be worth
organising more events to bring the potential problem to the attention of
the SMEs?

Muir Russell: Over the next month, we will continue with a programme of
ministerial statements and appropriate publicity. That will be designed to
get across what the Executive thinks are the right messages about the bug.
We need to raise awareness without being alarmist and to be confident
without being complacent. In this area, those are difficult balances to
strike. I am pretty sure that no opportunity will be lost to remind small
and medium businesses that they need to make checks, even at this late
stage. We will continue to raise awareness over the next month. Anyone in
the real world must be aware of the problem. I have a folder here with much
of the Action 2000 material that has been issued. There is plenty of
Government information available on the internet and in libraries.

Mr Johnston: I wanted to make the point that 35 per cent of businesses know
that there is a risk and have done nothing about it.

The Convener: We will now have questions on the state of readiness. I call
Paul Martin.

Paul Martin (Glasgow Springburn) (Lab): Mr Russell, on page 30 of the
report, paragraph 3.25 and figure 13 show the coverage of monitoring
returns that have been given by the Executive to the Cabinet Office. Why
are some Scottish bodies such as the National Library of Scotland not
included in those returns?

Muir Russell: The list to which you refer contains only the Scottish
Executive and its executive agencies. As the National Library of Scotland
is an non-departmental public body, it would have been picked within a
different range. Craig can say in which list we would find that body.

14:15

Craig Russell: When we expanded the whole public sector programme in May
1998, we carried out a large exercise that covered all public organisations
in Scotland. However, at the end of the exercise, it became clear that we
were in serious danger of overwhelming ourselves by trying to cover
everything. As a result, and because resources are limited, we decided to
concentrate on the organisations with the greatest public impact on the
delivery of main services. However, the Scottish Executive decided that,
instead of excluding such NDPBs from the monitoring process, we should
continue to monitor them and get returns from them, which we do. The only
difference is that we do not play those figures into the formal returns. It
would be an enormous exercise, as it was in May 1998, to get returns from
all those areas.

Muir Russell: That does not mean that the other bodies have not been doing
anything.

Paul Martin: In percentage terms, how confident are you that any millennium
failures in those bodies will not pose a risk to service provision in
Scotland?

Muir Russell: This question keeps being asked in various forms and I will
keep giving the same answer. On the basis of what has been done, I have no
reason to believe that there will be any materially disruptive failures. I
suppose that that means almost 100 per cent on your percentage scale.

Paul Martin: Would that be 99.9 per cent?

Muir Russell: I would like to leave my answer as it is. We should
appreciate that the process is a total one; we need to consider what it has
been designed to give confidence about. We have done everything that people
have spotted in the defined areas. As Craig said, although a substantial
infrastructure of other areas did not make it into the list, those areas
have been made aware of the problem and are being monitored by our more
general systems for NDPBs.

Paul Martin: Figure 13 on page 30 shows that more work is required on
non-critical business systems. What sort of systems are non-critical?

Muir Russell: Let me take the example of the Scottish Executive, which is
the first item on the figure 13 list. The critical systems were the office
automation package and the systems that handle student awards, pensions,
payroll and agricultural subsidies. Those are the big pieces of computing
that sit at the heart of many of the Scottish Executive's processes.

We move from such systems to systems that deal with flexi-credits for how
long people work, for example, and to a variety of smaller-scale
statistical packages that people maintain as part of their daily business
to produce publications and information. There is also the website and a
human resources database that records when people joined us, their
qualifications and so on. Those areas are non-critical, as they would not
make the business fail within a week or have health and safety
implications.

We widened the circle to consider areas such as the ones that I have
described; there are one or two areas at the tail-end of the convoy that
are being dealt with now. If small-scale statistical packages stopped
working, it would not make any difference to anybody outside the immediate
work area.

Paul Martin: Are not the payroll systems critical?

Muir Russell: Yes, they are critical. Perhaps I slurred over it, but I
mentioned that that was one of the areas in the critical frame.

Euan Robson (Roxburgh and Berwickshire) (LD): I refer to figure 14 on page
32, which deals with business continuity planning. The report was completed
a while back and I wonder whether you could update the information for us
now, particularly the column about testing the continuity planning. The
information suggests that seven of the 11 bodies—including the Scottish
Executive—had not tested the continuity plans and that some components
were missing.

Muir Russell: I have made sure that I could update you on that. The report
was put together using September 1999 returns, which were completed in
August. As the report was going to print, we let the NAO know that the
continuity plans of the Scottish Executive and the executive agencies were
complete and were being tested. They have now been tested and no problems
have been found, but we will keep refining and checking the plans. The
information liaison centre was tested on 26 October and will be tested
again on 9 December. Lessons that we learn will feed into the continuity
plans and the operating regime.

Euan Robson: Is the operating regime in a similar state of development and
are you satisfied with the progress?

Muir Russell: Yes.

Craig Russell: I would like to add to that. We will continue to refine the
operating regime that underlies the bunker until the new year. It has been
tested and has been delivered by the required date but—quite
rightly—work has not finished on it. We will test it on 9 December and as
often as necessary afterwards. It is easy to make assumptions, but
assumption is the enemy in this case.

Euan Robson: Paragraph 3.33 on page 34 talks about the overall cost
estimates. The figure that is given for the Scottish Executive and its
agencies is £4.5 million. Are there any specific figures for the health
service or local government?

Muir Russell: The figures that I have show that £45 million has been spent
in the health service. That represents a huge programme of testing,
checking and equipment replacement. The report says that 78,000 pieces of
equipment have been tested.

An additional £10 million was added to the resources of local government,
but that will be only a part of what was spent. The Scottish Executive
part-funded a managerial post at the Convention of Scottish Local
Authorities to help manage the process. Local government includes police
and £4.7 million was provided to cover additional costs. That includes
millennium events as well as the bug. There is a slight crossover between
the two categories that I identified. Training for SMEs cost £2.6
million.

Euan Robson: I think that one of my colleagues might wish to ask further
questions about that.

Brian Adam (North-East Scotland) (SNP): I will carry on from what Mr Robson
had to say. I note that paragraph 3.33 on page 34 mentions a cost of £4.5
million for millennium compliance work and that a substantial amount has
been added to that. Why is there such a discrepancy between that and the UK
cost of £434 million? Is that as a result of the other costs that have
been identified?

Muir Russell: There is a difficulty with classification in issues such as
this. That £4.5 million represents money spent that would not otherwise
have been spent—that spend is attributable to getting things right for
the millennium. I do not know whether the £434 million includes things
that other departments would normally have done, such as installing new,
and therefore millennium-compliant, computer systems. The calculation of
the figures that we have given was not based on money that would have been
spent anyway.

Within the £434 million, the figures for the Department of Health in
England show up as about £12 million or £13 million. Its exercise will be
equivalent to the one on which we have spent £4.5 million. Comparison of
the figures is an inexact science.

Brian Adam: Would I be right in thinking that all the expenditure—the
£434 million, the £4.5 million, the £45 million and so on—has been
funded from within existing budgets?

Muir Russell: All that has been spent will have been included in the
budgets for the years in which the money was spent. The expenditure was
built into the forecasts that we made for the running costs of the Scottish
Executive for this year and for the Scottish Office last year. Budgets
allowed for the expenditure, but whether we got the figures right is an
open question. I think that we were pretty close to what we budgeted for
the Scottish Executive. The expenditure was allowed for in the budgets that
we started the year with.

Brian Adam: So are you saying that money for that purpose was built into
the budgets of the Government agencies and other bodies that receive money
from the Government? Before we complete our report, could you give us an
accurate estimate of the figures that were agreed in advance for the work
and of what has actually been spent on it?

Muir Russell: I have given you figures—

Brian Adam: I am not suggesting that people spent money that was not
allocated. I am not making accusations.

Muir Russell: It is fair that you should want information about the whole
picture. The £4.5 million is for the Scottish Executive and its agencies.
I have a table before me that shows how the sums add up. The Executive
accounts for £2.3 million and Historic Scotland and other such agencies
account for the rest. If the NAO had wanted to include a health service
figure in the report, it would have. We would be happy to look into what
has been provided and what has been spent.

Craig Russell: I want to explain the difference between the Scottish spend
and the British spend. The Y2K problem is not peculiar to Scotland and
there is an element of reciprocity in the spend: the equipment that is used
in the NHS is similar throughout the UK. That means that if equipment is
tested somewhere, it need not be tested elsewhere. Also, a number of
agencies are British in nature, not Scottish, so the spending in some UK
departments covers Scottish infrastructure.

It is difficult to break down the spend into narrow bands. I have tried to
explain part of it, but I doubt whether anyone could explain it all in
detail.

14:30

Brian Adam: Would it be fair to say that the money is non-recurring and
that we would not expect those moneys to be available in the next financial
year?

Muir Russell: I am sure that that is right. Our plans do not go into the
next millennium.

Brian Adam: So could the £434 million that the UK departments have spent
on this exercise and the money that you have identified today—about £70
million or £80 million—be used for other purposes?

Muir Russell: It is fair to assume that those resources will have been put
into different bits of the budget for future years.

Brian Adam: Would it also be fair to say that other types of work have been
postponed? Have you had to put back other projects?

Muir Russell: That must be true, logically. If Craig Russell was not
working on this, he would be working on something else. If we were not
investing in the liaison centre, we would be spending the money elsewhere.

I cannot say what the money would have been spent on otherwise, and I
stress that we are talking about relatively small sums, but your point is
correct, because in Scotland, we are dealing with a determined total that
has to be divided up.

Brian Adam: The Scottish Executive has undertaken a fairly significant
auditing exercise. Have there been benefits for the public or private
sectors other than the immediate one of resolving the millennium problem?

Muir Russell: Yes. First, much of our technology will be more modern and
will have better software after the exercise.

Secondly, the discipline of thinking about one's business and continuity
plans will have been of value generally, in terms of how people do their
work and of our emergency planning drills. Some investment will be made
earlier than it would have been—folk are getting the benefit of new
information technology, which enables them to get their business done much
more briskly. Craig is more expert than I am, and might want to add to
that.

Craig Russell: There is also the benefit of the relationships that have
been established, particularly in the commercial sector, between companies
that previously would have held certain information to be commercially
confidential. Considerably more is now known about the interdependencies
than before we started the exercise. The importance of that cannot be
underplayed.

The Convener: We will now move on to the emergency planning arrangements.

Miss Goldie: Mr Russell, I refer you to page 35 of the report. Are the
existing emergency planning arrangements comprehensive, and have they been
tested? Have they been enhanced satisfactorily to allow for the millennium
bug threat and the millennium celebratory events to which you referred
earlier?

Muir Russell: The plans are comprehensive. There are general emergency
drills in what used to be the home department, and there are plans to deal
with business-specific problems that might arise, such as pollution and
water incidents. Our drills focus on particular groups of administrative
and professional officials who have the expertise and contacts with the
local authorities and quangos that are working in the area affected.

Miss Goldie: Have the plans been tested recently?

Muir Russell: We test them regularly. They are also tested at UK level, in
co-ordinated exercises involving the Home Office and the Cabinet Office.

Miss Goldie: Do we know when the previous test took place?

Muir Russell: There was a general test exercise on 26 October.

Craig Russell: There was one immediately before Exercise Herald—we called
it Exercise Hydra.

Muir Russell: That was in mid-October.

Miss Goldie: I am sorry for interrupting—I just wanted to establish that
point.

Muir Russell: That is all right. We are here to get this right between us.

Miss Goldie: Have the planning arrangements been enhanced to cope with the
additional threat posed by the millennium bug and the celebrations that
will be taking place throughout Scotland?

Muir Russell: Yes. Earlier, in response to a question about costs, I
referred to additional funding for the police, which covers millennium
policing costs as well as bug costs. Their systems must be able to deal
with the extra pressures to which they will be subject.

Ministers are concerned that winter and emergency planning in the health
service should be fully up to speed for the hogmanay events. The awareness
of people who are managing at the sharp end has been heightened, and they
have been given instruction and encouragement to ensure that they are
ready.

Miss Goldie: That is helpful. Did the test in mid- October take into
account the new arrangements that have been put in place, such as the
Scottish Executive emergency room—the bunker—and the Scottish Executive
co-ordinating committee?

Craig Russell: Exercise Hydra did not test the extension, which is the
Scottish information liaison centre. Exercise Herald tested that to some
extent, and Exercise Enterprise on 9 December will further test it. SILC is
an overlay, on top of existing emergency planning arrangements. It is there
to deal with the additional potential problems that arise from the
millennium.

Miss Goldie: Have any shortcomings emerged as a result of the tests that
have been conducted to date?

Craig Russell: It would be seriously remiss of me to suggest that any test
went absolutely correctly. From the point of view of the operational
director in the first hour, Herald was a complete storm of paper, by which
I was totally overwhelmed. If nothing else, we learned how to control the
volume of paper that can spew forth from nine or 10 faxes in an hour.

We have learned lessons. We learned that, if we have to bring all those
people together into one room, simple things are needed such as coloured
paper, so that it can be made clear whether a report is from the power
side, the water side, or whatever. It did not go absolutely smoothly, but
it went well; it certainly went better than I expected, but that is not to
underplay the lessons that we learned. We will attempt the test again on 9
December.

Miss Goldie: In the meantime, is action being taken to address those
shortcomings?

Craig Russell: Indeed.

Miss Goldie: The UK civil contingencies committee must be brought in if
there are dimensions of the millennium threat that involve the UK. I
believe that there was a one-day exercise for that. Did a Scottish minister
participate in that exercise?

Craig Russell: No.

Miss Goldie: Would not that have been a good idea?

Craig Russell: To some extent, the non-participation reflects the
difference that has arisen because of the way in which we have structured
the system in Scotland. We have a much smaller community, and SILC is not
replicated in the rest of the United Kingdom.

In most other instances, the chains of communication are conspicuously
longer. They go from the sector to the department, from the regulator to
the department, and from the department to the Cabinet Office. Ours come
directly to our central SILC group, then go directly from there to the
Cabinet Office. Therefore, we can apply intelligence at source. I can
question someone from British Telecom or the power sector to ask, "What is
the implication of this?" then determine whether it is necessary to forward
information to the Cabinet Office. The way in which our system operates is
somewhat different, which is why we are doing the additional test on 9
December.

Miss Goldie: I am grateful to you for that answer.

Within the bunker—which we know will contain Mr McLeish and Muir Russell,
and, no doubt, a few others—who will be in charge?

Muir Russell: That is a very good question. I do not want to get in the way
of the people who will be operationally in charge, who will have roles
assigned to them to communicate with the different bits of the world out
there. Let us be clear. If there were an emergency—of a particular
nature, such as a water emergency—the senior officials who handled that
area of administration would be on call and brought in. They would have
various roles assigned to them, including that of deciding what to say to
the media and when to call in the minister, if the problem was of that
intensity.

A set of hierarchies has been defined, but I cannot tell you off the top of
my head what those are. Ultimately, unless and until there is a minister
around, I will carry the can for what happens in SILC and the Scottish
Executive emergency room network on hogmanay. If things escalated—if
there were problems—we would, of course, involve ministers, address how
to inform the media and decide on the crisis responses that needed to be
taken. There is a hierarchy that begins with initial alert responses and
continues according to the escalating seriousness of any situation.

Miss Goldie: Given that Mr McLeish, in all fairness, intends to be present,
will he be the Executive figure with responsibility for what happens, or
are there arrangements for other ministerial contact?

Muir Russell: There would certainly be arrangements for other ministerial
contact if something was happening that engaged the interests of the
Minister for Health and Community Care, for example, or the Minister for
Children and Education. They would be contacted—there are no two ways
about that. We might rely on telephone contact if they were not in
Edinburgh, or they might be able to get to one of our other offices—we
would play it as sensibly as we could.

The essence of the SILC idea is to have a series of layers of communication
potential, so that, if there were problems with one method of
communication, we would have triple redundancy—I think that is what Craig
calls it.

Miss Goldie: How tempting. [Laughter.]

I revert to my earlier point, to which Craig Russell was helpfully
responding. Can you assure us that you are satisfied that the arrangements
that allow the Scottish Executive co-ordinating committee to call on the
resources of the UK civil contingencies committee will handle
satisfactorily any emergency that arises?

Muir Russell: Yes.

14:45

Miss Goldie: How rigorous were the assessments of the fire, police and
health care services? What monitoring arrangements are in place to ensure
that the blue status is maintained?

Muir Russell: As I said, the health service assessments were rigorous. We
heard how much had been spent on the absolutely enormous range of checks
that were made.

The other services were checked as part of the framework, which is
explained in the report, and members can see who the independent assessors
were. Our professional experts, including HM chief inspector of
constabulary and HM inspectorate of fire services, carried out the exercise
on the basis of the published information on what needed to be done that
was provided by Action 2000. Information technology or other technological
professional expertise was acquired for them. There was a solid basis on
which they carried out that work, which is why we have this degree of
confidence. However, your point is well taken. No one is assuming that they
can relax because a check was made a while ago. We have been explaining the
business of polishing up the rules and regimes, and that will continue
until the end of the month.

Margaret Jamieson (Kilmarnock and Loudoun) (Lab): Could you indicate what
special arrangements have been made to ensure that sufficient staff from
the emergency services will be available over the millennium period to
handle the extra incidents that might occur?

Muir Russell: Those are matters for the managers of the emergency services.
There has been debate about overtime, bonuses and so on, but I am
reasonably comfortable that those people are in a position to roster their
staff so that teams are available and call-out arrangements in place. They
are building on the plans that would normally be in place for such a busy
time and on their emergency plans.

I am pretty comfortable that staff numbers have been considered by the
various services and that the plans are in place. Certainly, the Scottish
Executive knows who will be there and who will be on call if particular
subject-specific emergencies arise. We are arranging rosters to cover quite
a long period, so that people know when they might have to come in, when
they can relax and when they cannot relax. The Scottish Executive has
considered all those factors, and that is typical of what is happening
across the board.

Margaret Jamieson: Are you satisfied that, together with the normal
emergency planning procedures, the relevant authorities have taken into
consideration the number of individuals who will be within the city
boundaries of Glasgow and Edinburgh, in particular on the evening of 31
December?

Muir Russell: Yes.

Margaret Jamieson: You are quite emphatic about that.

Muir Russell: Yes. It is only a month away and I am pretty comfortable that
the hospital managers, the police and so on have been thinking carefully
about how they will deploy resources to handle that evening.

Lewis Macdonald (Aberdeen Central) (Lab): Members who have coastal
constituencies are aware that the real fourth emergency service is the
Maritime and Coastguard Agency, for which you are not directly
responsible—at least, I take it that you are not directly responsible for
it. Can you confirm that the agency is not a Scottish Executive
responsibility in the context of the millennium? Can you tell us how the
agency's emergency preparations will be linked into those of the other
emergency services?

Muir Russell: You are right. That agency is not one of our direct
responsibilities. As a national agency, it is handled by the Department of
the Environment, Transport and the Regions and, therefore, it will have
been part of the bigger picture of infrastructure services that is
accredited through the DETR. I will ask Craig if he knows precisely what
information we have about the state of play. If it turns out that we do not
have anything in our archive, we can certainly come back to the committee,
but Craig may be able to advise you.

Craig Russell: I have two points, the first of which is an enlargement of
the emphatic yes. To some extent, these matters have been thought through,
in the good civil service way, by a steering group. The SILC steering group
comprises representatives of all the parties that will be involved in the
programme, including the police. People from the emergency services are
participating, and they have contact with the coastguard as part of the
normal emergency planning arrangements. That area has therefore been
covered; it has not been forgotten. In the event of a boat being in
trouble, SILC would play a part in the arrangements for coping with the
situation, but the matter would pass from my control to the control of the
emergency planning services.

The Convener: In the past, there has been concern about large ships using
the Minch. Has that been considered in the context of Y2K?

Muir Russell: I am confident that it has been, but I do not know any more
about it than that. If you want me to follow through on that point, I will
be happy to provide a note to the committee on just what the pathways are
for the responsible body and how independent assessment is being handled.

The Convener: I would appreciate that. I call Cathie Craigie to ask about
the section on information.

Cathie Craigie (Cumbernauld and Kilsyth) (Lab): Action 2000 has been able
to provide a UK-wide publicity campaign to advise the public about the
readiness or otherwise of the UK to deal with the millennium bug. Paragraph
3.19 on page 29 states that the Scottish Executive has held

"Scottish Infrastructure Conferences aimed at senior executives"

and

"Scottish Infrastructure Forum events . . . designed to spread good
practice and share information",

and has

"implemented a Year 2000 media strategy aimed at encouraging senior
executives in business to take appropriate action and remain vigilant about
Year 2000 risks".

What action has been taken to inform the Scottish public about the position
of local organisations assessed under the UK national arrangements?

Muir Russell: Those outcomes have derived from the central efforts that you
describe. Since the Executive was created, we have been marching in step
with the announcements that Margaret Beckett has been making in London. As
the blue ratings have come through, the readiness of services is something
that has been publicised reasonably well.

Good news tends not to be publicised—that's life. However, we have
thought carefully about getting the right pitch in the strategy. As I said,
one wants to convince people and to make them aware of what might have
happened and what is being done. We wanted to raise awareness without
alarming people and that is what we have been trying to do. We have also
tried to give people confidence in what has been done without giving the
impression that we are complacent. That would be wrong, as we need to keep
the pressure on right to the end.

All those conferences have been helpful. Ministers have made news releases
about their various functional areas: Angus MacKay for the justice
elements; Peter Peacock for education; and Susan Deacon for health. Mr
McLeish's speech in Parliament just 10 days ago got quite good coverage. We
have also arranged a number of visits to utilities, banks and so on, and
will back those up by press releases. That is what has happened so far.

The media will be invited to view the SILC operation on 17 December and we
will try to get coverage of that event. Again, we will show that we are
confident but not complacent. Explanations will be given about what has
been done and what will be done during the festive period. We will be
pushing out information over the next wee while. There will not be a huge
escalation of publicity that will say, "Things are all wonderful", or
"You've been saved" or whatever. Instead, there will be a gentle,
continuing push to demonstrate in appropriate ways what has been done and
what we think will happen next.

Cathie Craigie: You mentioned a continuing process between now and the end
of the year. I am pleased about that, but what action will you take to
advise the general public that SILC is easily contactable should anything
go wrong? When will you start advertising that service?

Muir Russell: The public will not have direct contact with SILC. MSPs will
be able to contact it. Craig Russell and his colleagues are making
arrangements for a set of access numbers to be available, because there is
often a problem with getting past switchboards on such occasions. SILC will
have direct, quick, fail-safe channels out to the various infrastructure
providers and emergency services.

If people are affected by anything that happens—by an emergency or by a
bug-related incident—and want to contact the relevant infrastructure
provider, they will do so directly, using the numbers available in the
telephone book. We also expect that cut-out-and-keep information will be
published in the newspapers during the 10-day period before Christmas.
People will contact the providers in the normal way if an emergency
occurs.

The providers have been learning lessons. For example, Scottish Power has
learned some effective lessons from the difficulties faced last year by
people in the central belt as a result of the boxing day storms. The
company has greatly expanded its ability to cope with a flood of calls.
Other companies will take similar action to avoid some of the rather
strange occurrences we have seen in the past week or two. People are on the
case, making normal systems work better.

SILC is about ensuring that there is proper liaison inside the system and
that people know what is coming. It will ensure that the people who have to
co-operate have ways of getting in touch and co-ordinating, in
circumstances when their public face is blocked up by dealing with the
client emergency.

Cathie Craigie: That is good. Scare stories have circulated about the
emergency services being unable to cope, but you seem confident that they
will cope. I am grateful that MSPs will have that hotline number, although
I hope that we will not have to use it.

The Convener: For those who want to visit sunnier climes, we move on to the
final section, which is about the overseas situation.

Scott Barrie (Dunfermline West) (Lab): Or wetter climes—I am going to
Ireland.

Paragraph 4.12 states that the Foreign and Commonwealth Office website had
had over 250,000 hits by mid-October. That shows that there is much
interest in what is happening abroad. What work has the Executive
undertaken to identify the effects on Scotland of overseas failures?

Muir Russell: This bit of the report is focused on the UK level and does
not purport to cover the activity of the Executive. The matter to which you
are referring has been handled as part of the UK effort, with Foreign and
Commonwealth Office responsibility. I do not want to claim that we have
gone beyond what is being done elsewhere. There has been a huge effort, as
members can see, to make assessments of what is happening abroad and to
give people the best possible advice, but one would not have expected that
to be channelled through the Executive or for us to play a significant part
in providing it.

15:00

Scott Barrie: I can fully understand that. However, do you feel that there
may be any remaining risks in this area of which we should be aware? From
what we have heard this afternoon and in previous debates, it is clear that
we have been incredibly proactive. Other countries seem to have taken a
less robust attitude towards the problem and to be waiting about to see
what may happen, rather than preparing for all eventualities.

Muir Russell: These assessments are designed to enable people to judge
whether that is the case; it is difficult for me to second-guess that. As
you say, there is a great deal of speculation and comment of one kind or
another about who may have got this right and who may have been taking a
chance. I am not able to give you a Scottish Executive guide to which
airlines not to fly. I would not be able to do that anyway, but I certainly
will not do it for the end of December.

The Convener: What assurances can you give about air traffic control for
aircraft that take off from Edinburgh, Glasgow and so on?

Muir Russell: Air traffic control is a key part of our infrastructure and
has been checked thoroughly. To the best of my understanding, it is well
into the blue.

Craig Russell: People should have no fears about taking off from or landing
at British airports. What happens to planes after that is a matter for
other countries. As Muir said, that is not a matter in which we have
dabbled.

The Convener: What advice would you give to people who are travelling to
other countries?

Muir Russell: The best advice is to go through the information channels
that are described in this section of the report. There are web addresses
from which people can get the best assessments that the Foreign and
Commonwealth Office has been able to come up with. That is the answer.

Craig Russell: Setting aside the scare stories, we should bear in mind that
no airline will fly into danger because the costs that it would incur in
litigation if it were known to be flying somewhere that was unsafe would
not be sustainable.

Scott Barrie: Paragraphs 4.14 and 4.16 indicate that people have to trawl
through a fair amount of information to get to the relevant bits. Do you
regard as satisfactory the provision of information to people who may be
overseas over the millennium period, as I will be?

Muir Russell: Given that modern IT enables people to access the whole world
from the whole world, I suppose that people are better able to access this
information from abroad than they are many other things. I hope that the
consular service and others will be helpful.

The Convener: We now move into an open session. Do members have any further
questions?

Brian Adam: Currently, there is an interesting experiment under way in the
justice system in Scotland with electronic tagging. Has anyone given any
thought as to whether that will be Y2K-compliant?

Muir Russell: I do not have a specific answer to that question. I have not
heard that it is not. I am not sure that there are dates running in the
systems.

Brian Adam: They must incorporate date and time arrangements. That is the
whole point.

Muir Russell: We would be happy to check and come back to you on that.

Brian Adam: I know that it will affect only a small number of cases.

Muir Russell: It is hard to believe that people checking the systems would
not have noted that. I do not know the answer because I have not seen a
list of the things that have been checked, but I would be happy to look
into it.

Scott Barrie: Criminal justice has said that it is blue-compliant, so
presumably the tagging systems have been checked.

Brian Adam: Electronic tagging is not prison.

Scott Barrie: It is part of the criminal justice system, through the
Scottish Courts Administration, which is blue-compliant. That means that it
must have been one of the things that was checked.

Craig Russell: That would have been written into the contract. Nearly all
contracts that have been let in the past 18 months to two years include a
millennium date compliance clause.

Paul Martin: Earlier we talked about the non-critical systems. When will
they be completed? It is only 38 days to the millennium. Are we not leaving
it a bit late?

Muir Russell: The report estimated that there were 13 left; that was at the
end of September. We reckon that three or four have not yet been completed.
They are the tiny things to which I referred and will be completed in good
time, in the early part of December. I am seriously unworried about any of
the small systems, even if they were not completed. However, they will be.

Paul Martin: That does not answer my question. Are we not taking this
process right down to the wire? Do you not think that we should have
completed it much earlier?

Muir Russell: Perhaps, in an ideal world. I was asked what I would have
done differently. It was almost inevitable that something would be at the
end of the queue, and that that would be a non-critical small internal
system. To that extent, I think that this is not something that we should
worry about. The point that you have made is a fair one: if we had had more
resources and more time, it would have been be nice to have completed these
systems sooner. However, we would then have run the risk of falling into
another trap that is identified in the document—of thinking that we had
got everything out of the way months ago, forgetting about it and not
keeping our foot on the accelerator right up until 31 December.

The Convener: I want to raise another possible fear, so that you can
respond to it. What assurances can you give about nuclear power stations?

Muir Russell: They have been very thoroughly and fully checked. People are
not daft and nuclear power stations were at the top of the critical
list—or should I say, the list of things that need to be looked at with
care and attention. I should not use the word critical in the nuclear power
context, and I apologise for that. However, there was considerable
inspectorate input in that area.

Margaret Jamieson: What consultation has there been between the Scottish
Executive and the various insurance companies? I understand that the risks
that the insurance companies have indicated they anticipate have sent
premiums through the roof, which has meant that many organised events have
had to be cancelled. Have you had any discussions with those companies to
make them aware of the work that you have been doing?

Muir Russell: Are you referring to organised millennium events?

Margaret Jamieson: Yes, because of the public safety aspect.

Muir Russell: I am afraid that I do not know about how those events are
insured, but I suspect that the fact that Craig is nodding indicates that
he does.

Craig Russell: Yes. I spend my life shifting from one crisis to another.

Margaret Jamieson: I spend my life travelling along the M8, so I heard
about this on the radio today.

Craig Russell: Never pay attention to what you hear on the radio.

The Convention of Scottish Local Authorities ran a seminar with Zurich
Insurance Company after the issue of public insurance liability was raised.
I am not sure about your point about premiums going through the roof; even
if I were, I doubt whether I would comment on it. However, insurance
companies have concerns and have indicated that they will not cover certain
types of event. Those do not include the street party in Edinburgh, which
is insured in an entirely different way because it is run in a different
way.

Lewis Macdonald: You said that there was no likelihood of recurring
expenditure in this area. Can we take it from that the alternative
millennium date of 01/01/01 is not expected to cause any difficulties with
IT systems?

Muir Russell: We know that 29 February might, and we are on the case there
in the sense that the regimes, fixes, tests and so on that have been done
for hogmanay take account of that date as well. We are also aware of what
are called date discontinuity problems, which could run for a while. In the
time available, it was not always possible to put in four-digit dates, and
that will have to be put right. The technical world knows that and we will
keep the pressure on to ensure that it is done.

We will not stop running infrastructure events straightaway. We may run one
before 29 February and we will certainly run one early in the new year, on
the devil-was-well principle. We need to remind people that some of the
fixes that have been done need to be made more permanent. I have not heard
it suggested that there is a problem with the proper millennium.

The Convener: If there are no more questions, I will thank both our
witnesses on behalf of the committee for their responses during what has
been a very long session. The clerk to the committee will write to you if
the committee requires any additional written information or evidence. I
hope you do not mind remaining seated for a moment, as we must make one
more decision.

The committee now needs to consider its response to the evidence that it
has heard today, and what additional information it requires as it begins
to draft its report on this subject. I suggest that it would be appropriate
if those discussions were held in private. Is it agreed that the rest of
the meeting be held in private?

Members: Yes.

The Convener: Once again, I thank both our witnesses for their
contribution.

Muir Russell: Thank you for showing such courtesy in listening to us. The
discussion was very enjoyable.

15:11

Meeting continued in private until 15:27.


This work is protected by copyright. All rights reserved.

The SCOTS Project and the University of Glasgow do not necessarily endorse,
support or recommend the views expressed in this document.

Document source:
http://www.scottish.parliament.uk/business/committees/historic/audit/or-99/au99-0801.htm

Information about document and author:

Text
Text audience
General public: Audience size: 1000+

Text details
Method of composition: Wordprocessed
Year of composition: 1999
Word count: 10830
General description: Committee Report. See http://www.scottish.parliament.uk/business/committees/index.htm

Text medium
Web (webpages, discussion boards, newsgroups, chat rooms): 
Text publication details
Published: Publisher: Scottish Parliamentary Corporate Body
Publication year: 1999
Place of publication: www.scottish.parliament.uk

Text setting
Government/politics: 
Text type
Report: Written record of speech (e.g. hansard, legal proceedings, minutes of meetings): 

Author
Author details
Author id: 908
Surname: Scottish Parliamentary Corporate Body