Individual Learning Accounts - Case Nos. C.1413/02 and C.1401/02

Parliamentary

Access to official information

Health

Parliamentary

Access to official information

Health

Hot topics

Cymraeg

Freedom of Information

Accessibility

Other Ombudsmen and complaint handlers

Feedback

Satisfied with our service?

Parliamentary Ombudsman

The complaints investigated

Case No. C.1413/02

1. A complained that he was unable to register his training course to obtain a discount under the Department for Education and Skills’ (DfES) Individual Learning Account scheme (the scheme) before the closure of the scheme on 23 November 2001, because his Individual Learning Account (account) had not been adequately safeguarded by DfES and had been fully used without his knowledge, leaving him responsible for the full cost of the course.

Case No. C.1401/02

2. Mr Tuckett that DfES failed to establish and operate adequate controls and safeguards in respect of the scheme, leaving it open to fraudulent activity. He complained that DfES failed to respond adequately to queries about the rules of the scheme during its operation and failed to give guidance to learning providers about the arrangements for and implications of closure of the scheme when that was announced on 24 October 2001. He complained that DfES gave no contractual notice to learners or learning providers when the scheme was prematurely curtailed on 23 November 2001. He also complained that the scheme was poorly administered by DfES’s contracting agency, resulting in unacceptable delay in the issue of registrations to some students and a backlog of outstanding payments at the time the scheme was suspended; and that the contracting agency subsequently delayed making those payments. He further complained that although DfES had, through the scheme, encouraged a growth in the market for basic IT training, they unreasonably refused to accept any responsibility for the consequences on that market of the withdrawal of the scheme. In particular, they refused to offer any compensation to learning providers such as Mr Tuckett’s company (the company), who faced hardship as a result of the withdrawal of the scheme.

3. The investigations began in March 2002 once the Ombudsman had received the comments of the Permanent Secretary of DfES after the referral of the complaints by the referring Members. I have not put into this report every detail investigated by my staff, but I am satisfied that no matter of significance has been overlooked.

4. Following the general election in June 2001 and the subsequent reorganisation of Government departments, the Department for Education and Employment was reorganised and the scheme became the responsibility of DfES. For ease of reference I will refer to DfES throughout this report.

5. The Ombudsman’s remit, which is laid down by the Parliamentary Commissioner Act 1967 (the Act), is to consider whether administrative fault by the bodies that fall within her jurisdiction has resulted in an unremedied injustice to the aggrieved person, and if so, to invite appropriate redress. Under section 5(2)(b) of the Act the Ombudsman is generally debarred from investigating matters where there is a remedy in law. Under section 12(3) of the Act, the Ombudsman may not question discretionary decisions taken without maladministration. She has no powers to question the merits of Government policy, and where a policy has been embodied in legislation the matter is even further beyond her investigative reach since the content of legislation is a matter for Parliament.

Policy background to the scheme

6. In May 1997 the Labour Party published its election manifesto, which included a commitment to promote lifelong learning for adults. The manifesto said that, if elected, a Labour Government would invest public money for training in individual learning accounts which individuals could then use to gain the skills they wanted, and would give one million people each a contribution of £150 towards funding their training, to which they would be expected to add small investments of their own. The target was for there to be one million accounts by March 2002. In 1998, the Government published a green paper on lifelong learning, “The Learning Age”, which set out in more detail DfES’s plans for the scheme.

7. In his budget speech of 9 March 1999, the Chancellor of the Exchequer outlined the financial incentives that would be available under the scheme.[1] He said that the Government would introduce individual learning accounts and open up tax-free learning in basic and advanced computing. The first million adults to use an account would each receive £150 to be put towards the course of their choice. Once that offer was exhausted the scheme would provide discounts on learning costs. Any adult with an individual learning account would also be able to claim a discount of 20 per cent (an additional grant of up to £100) on the cost of vocational learning. For all adults signing up to improve their basic education, including computer literacy, there would be a discount of 80 per cent on course fees. DfES subsequently set aside a budget of £199 million over the two years 2000-01 and 2001-02 for the scheme.

Legislative and administrative background

8. Sections 104, 105 and 108 of the Learning and Skills Act 2000 gave the Secretary of State the power to make regulations appertaining to the provision of qualifying accounts and grants for certain types of education or training. The Individual Learning Accounts (England) Regulations 2000 (the Regulations) laid down the conditions under which persons were eligible to open individual learning accounts. Under Regulations 5 and 6, grants were payable to account holders in respect of education or training of a kind specified by the Secretary of State, provided by a person who had registered with the individual learning account administrator and whose registration had not been withdrawn. Under Regulation 7, the amount of any grant payable was to be determined by the Secretary of State. Under Regulation 8, the Secretary of State could determine the terms on which the grants were to be paid. Regulation 8(4) provided that a learning account administrator could pay grants under arrangements made by the Secretary of State. The Act and Regulations came into force on 1 September 2000.

9. The Individual Learning Accounts Centre (the service centre) carried out administration of the scheme, operated on behalf of DfES by a private sector partner, Capita Business Services Ltd (Capita). To qualify for subsidised learning under the scheme, individual learners had to apply to the service centre to open an account by completing an application form which could be obtained by contacting the service centre by telephone, letter, e-mail or by means of the scheme’s website. Until 28 September 2001 the service centre also supplied stocks of blank application forms to learning providers for issue to prospective applicants. Learners were subject to eligibility conditions in respect of age and residence in England, and had to register for a course of eligible learning with a learning provider registered under the scheme. That entitled the learner to the incentives available under the scheme, which took the form of a subsidy in respect of the course costs, to be claimed by and paid directly to the learning provider.

10. To be able to offer, and receive payment of the subsidy for, eligible learning under the scheme, learning providers were required to register with the service centre. To register, learning providers had to complete a simple form to confirm that they would comply with various terms and conditions, and also with a number of operational requirements. Upon enrolling a student who identified that he or she was an account holder and who wished to use the incentives available under the scheme to pay for part of his or her learning, the learning provider was required to access the service centre’s computer database by means of the Internet, (there was also a paper-based alternative for the small number of learning providers who did not have IT facilities) and to record that the student had commenced an eligible course. For that purpose, the service centre issued registered learning providers with a user identity and initial password. Claiming incentives was a two-stage process. In the first stage, the learning provider was required to “book” learning by entering the details of the course that was to be undertaken and the account holder’s membership number. The system would check that the student existed, was an active member of the scheme, and that the incentive payment for which the student was eligible had not already been used up. The learning provider then entered the amount of the incentive being claimed; the system would confirm the maximum amount of incentive available; and the learning provider asked the system to register that episode of learning. The system would then display the account holder’s details for a final check. In the second stage, the learning provider was required to access the system again to “confirm” that an episode of learning had actually started and enter the date on which it began (courses could not be confirmed until seven days after the start date). Once the learning had been confirmed, the system would automatically generate a periodic claim by each learning provider to DfES. Incentive payments approved by DfES were paid directly into the learning provider’s bank account. DfES were responsible for final authorisation of all incentive payments.

11. DfES’s published rules of the scheme said that scheme incentives could not be claimed retrospectively where a person had already paid for his or her learning, and specified that “arrangements [to claim incentive payments] must be made at the time a person enrols and pays for their course”. There was no stipulation in the published rules in respect of the date from which an individual’s membership of the scheme became effective.

Administrative requirements in respect of fraud and data security

12. “Government Accounting”, a guide on accounting and financial procedures for Government departments published by HM Treasury, says that departments should actively manage risks, including the risk of fraud, and should take steps to prevent and detect fraud. At the time the scheme was being devised further guidance was contained in a booklet “Managing the Risk of Fraud - a Guide for Managers”, published by HM Treasury in November 1997. The booklet said that departments should identify by means of risk assessment the areas vulnerable to fraud. Where the risk of fraud was identified, departments should evaluate existing controls and if necessary implement additional controls. On the subject of data security, the guidance said that access to computer systems was an important area which should be very tightly controlledand that departments should safeguard against the theft or misuse of sensitive information. The guidance also identified grant funding as an area particularly vulnerable to fraud. From November 2000 much of the guidance in the booklet was incorporated directly into a revised edition of Government Accounting. The section on fraud management in Government Accounting says that although the guidance is generally advisory rather than mandatory, departments should follow it unless there is good reason not to.

13. Access to personal data held on computer systems is governed by the Data Protection Act 1998. Schedule 1 to that Act sets down the principles of data protection to which data controllers are required to adhere. The seventh principle, which is set out in Schedule 1 Part 1 paragraph (7), requires that appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data. Schedule 1 Part 1 paragraph (12)(b) says that where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller is not to be regarded as complying with the seventh principle unless the contract requires the data processor to comply with obligations equivalent to those imposed on a data controller by the seventh principle. The Data Protection Act 1998 defines a data controller as “a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed”. A data processor is defined as “any person … who processes the data on behalf of the data controller”.

14. In April 2000 the Office of the e-Envoy published a framework policy expressing the security requirements of “information age” Government services.[2] The scope of that document includes functional security requirements appropriate for the delivery of services by and on behalf of Government to citizens and businesses. The requirements were also applicable to the delivery of Government services by third party providers. Paragraph 32 of the framework states that in considering the protective measures to be put in place within “information age” Government systems, a risk analysis must be performed. That risk analysis must consider the intent, motivation and capability of sources of threat; the feasibility of methods of attack; the nature of vulnerabilities that may be exploited; the value of assets to be protected; the consequences of a successful attack; and the cost of any counter-measures. Paragraph 43 requires that access granted should be the minimum required for the identified user to obtain the service required, and that the user should only be able to access those parts of the system and data necessary to perform the authorised task. Paragraph 45 requires that legitimate users, once granted system access, cannot influence system data that the required service does not need.

Investigation

15. 1999 In May, DfES published a booklet entitled “Individual Learning Accounts - a Summary of Progress”, in which they outlined their plans for the operation of the scheme. DfES said that they intended to operate key elements of the administration of the scheme through a central customer services resource operated through a public/private sector partnership. They said they would look to learning providers (amongst others) as “potential partners in individual learning accounts”, to consider how the scheme would affect the market in which they operated, and attract new customers. On 25 August DfES placed an advertisement in the Official Journal of the European Community which said that DfES intended to procure a service to implement the scheme and invited applications to operate the service. The closing date for applications was 1 October. DfES then envisaged that the contract would be awarded by April 2000, that services would be required from June and that the service would be fully operational by September.

16. In late September 1999 Ministers agreed the outline for the scheme’s national framework and an associated briefing pack to potential bidders for the contract to run the supporting infrastructure for the scheme. The briefing pack was to include a pre-qualification questionnaire, for return by 1 November, to enable DfES to assess the ability of each organisation submitting a bid to operate the required service. In light of research and of discussion with financial institutions, Ministers decided that the scheme would not be based on a savings account model, where individuals could bank and save their own money in addition to contributions from others such as Government, employers and trade unions, as had initially been envisaged. However, Ministers agreed that, in order to attract adults back into learning, the scheme needed to be simple and flexible and should provide learners with personal control and responsibility.

17. On 1 October consultants appointed to assist DfES with the development and launch of the scheme’s national framework produced their market feasibility report. That report contained a section on operational risks and detailed a number of risks associated with the launch of the scheme within the required timescale. The report recorded that a project risk register had been established and was held by the scheme’s project team. [Note: the earliest edition of the risk register on DfES’s files is dated February 2000; I have not seen the version of the register referred to in the consultants’ report.]

18. In October, DfES issued the briefing pack (paragraph 16) to prospective bidders. The briefing pack outlined the policy objectives of the scheme and set out in some detail DfES’s requirements for the operation of the customer service centre, in terms of the expected inputs, the data to be maintained, the expected transactions and the required outputs. The briefing pack also said that the customer service centre would be required to satisfy four information requirements: the availability of data; the currency of data; response times for data access; and accuracy of data. [Note: there was no specification in the briefing pack in respect of the security of data or data protection.]

19. On 26 November officials informed Ministers of the bidders to be shortlisted and offered an analysis of their strengths and weaknesses. On 6 December DfES issued to the shortlisted bidders an invitation to negotiate, which included a draft contract and a statement of requirements. The draft contract drew prospective contractors’ attention to the Data Protection Act 1998 and required that they undertook to comply with all provisions of that Act. A schedule to the statement of requirements listed a number of pertinent issues. The schedule included a requirement that the contractor should explain how the customer service centre might prevent, detect and deal with external fraudulent incentive claims, which was said to be a priority issue for DfES.

20. On 15 December Ministers approved the final model for the scheme.

21. The procedures and considerations involved in the eventual approval of Capita as the preferred customer service provider (paragraph 9) are commercial-in-confidence. However, I have seen relevant papers including Capita’s response to the invitation to negotiate. That response contained a section on known risks and assumptions, which confirmed that Capita had considered the risks inherent in the scheme, in particular the potential disruption to the project fulfilling its objectives. The response showed that Capita had also considered the risk of fraud. Capita said that their processes and information systems would be designed to help prevent fraud, and that they would implement a reporting and monitoring procedure to enable DfES to be made aware of fraud. The probability of fraud occurring was expected to be low.

22. 2000 On 18 February a meeting of the scheme’s contract management group recorded that, although the project’s risk register was in place and circulated regularly, there were concerns about the risk management strategy. [Note: those concerns were not specified in the note of the meeting.] Officials undertook to facilitate a workshop on risk assessment. On 8 March officials submitted a paper on risk management to the programme board. [Note: the programme board included DfES senior policy staff and representatives from DfES’s internal audit team but did not include a representative of Capita.] The paper said that a workshop had been arranged to review and agree the risks to the project, and develop a strategy for managing the key risks. Enclosed with that paper was the project’s risk register dated 8 February 2000. At that stage the register recorded 16 risks, most of which concerned the possible failure to deliver policy objectives and meet Ministerial targets. None of the recorded risks related to the possibility of fraud or abuse of the scheme. On 13 March the risk management workshop took place. The record of that meeting shows that by then 24 risks had been identified, and that consideration had been given to operational risks. Among the new risks identified were that customers might not be satisfied with the quality of training received; the risk of opening up to all learning providers too soon [the record does not specify what risks that might entail]; and the lack of control over demand. There is no indication in the record that the meeting considered the possibility of fraud or abuse of the scheme.

23. Also on 13 March officials updated Ministers on progress on procurement. They recommended to Ministers that Capita should be advised that they were the preferred bidder. Their analysis of the bid and the key issues made no reference to the possible risk of fraud or the security of data. On 17 April officials recommended that DfES should issue Capita with a letter of intent that day, to enable them to start work on the customer service centre’s infrastructure. They noted that DfES had little room for manoeuvre in terms of timescales if the scheme was to be operational by September and said that it had not yet been possible to negotiate all the details of the full contract.

24. On 27 April an official wrote an internal e-mail commenting on a “strategy group paper on learning providers”. [Note: I have not had sight of that paper, as DfES have been unable to locate it.] She noted among other points that the statement of requirements for the scheme had initially restricted registration of learning providers to those registered with the Further Education Funding Council and approved by Training and Enterprise Councils. Subsequently, the intention had been to include learning providers covered by quality assurance arrangements in place through the Learning and Skills Council. However, the strategy group paper implied that the intention had changed so that account holders could undertake training with any learning provider. The official also noted that the customer service provider had not been asked to undertake any checks in respect of the quality of learning provision or health and safety. [Note: I found no response to that commentary on DfES’s files.]

25. At a meeting between DfES officials and Capita representatives on 4 May it was accepted that it would not be practicable to establish a link between the learndirect[3] database of registered learning providers and the scheme’s computer system because of technical difficulties of data incompatibility.

26. On 2 June DfES and Capita signed a preliminary contract, which they referred to as the Individual Learning Account Service Provider Agreement. On 12 June the service centre became operational and started to accept registrations of learning providers. In June, the service centre wrote to a selection of public and private sector learning providers inviting them to register for the scheme. The service centre enclosed a registration pack which included a registration form, a definition of the types of learning eligible for incentives under the scheme and a set of terms and conditions. Prospective learning providers were required to confirm that they held a United Kingdom bank account, that they complied with current health and safety requirements and that they held valid public liability insurance. The terms and conditions also stated that registration with the service centre did not guarantee the quality of learning provision and that registration was an administrative process only; and that learning providers should not promote their learning provision as being approved or accredited by the service centre. [Note: the precise date of the service centre’s letters is not clear from the copies on DfES’s files.]

27. On 19 June the project risk register was revised. Among the risks added to the register was the possibility of “creative pricing” by learning providers, in recognition that some providers in the private sector might seek to inflate course prices before the launch of the scheme. As a counter-measure DfES proposed to monitor complaints from learners. If necessary, as contingency measures, market mechanisms could be utilised to level prices and the discount and incentive mechanisms could be revised. The register also recorded that there was a risk of deliberate fraud by learning providers, who might use fraudulent practices to access scheme funds, for example by submitting “ghost” learners. [Note: there was no reference to the possibility of computer fraud.] DfES proposed various counter-measures including the development of fraud monitoring procedures; liaison with awarding bodies, professional institutions, and suitably placed local bodies; and the institution of an audit regime. The proposed contingency measures were to revise the system of authorisation of learning providers, and to revise procedures. The register records that the risk of deliberate fraud carried a low probability and would have a low impact on the operation of the scheme. On 2 August the Minister agreed that a cap of £200 should be introduced from 1 October on the 80 per cent discount available for certain maths and computer literacy courses (paragraph 7) with a view to reducing the cost to the public purse. [Note: the effective date of the imposition of the cap was subsequently put back to 23 October.]

28. On 4 September the scheme became fully operational.

29. On 9 October officials referred to the programme board a report of a review of the risks to the programme. The review recorded that “The trend on this risk has worsened” in respect of the risk of creative pricing from learning providers, and that the probability of the risk of fraud by learning providers had increased from low to medium. Capita had drawn attention to one company that had supplied “dubious trainee data”, while the activities of eight other learning providers gave cause for concern. The report said that there was to be a general audit of those providers in November.

30. Also on 9 October the High Court ruled on an application by a learning provider for judicial review of a decision by DfES to de-register the provider from the scheme and so prevent the provider from offering the 80 per cent discount (paragraph 7) on a particular course that the provider was promoting. In rejecting the application, the Court said that it was “manifestly incumbent on a public authority to obtain best value for their money, whatever the budget involved”. If experience showed that there were defects in the scheme which impeded its objectives from being fully realised, DfES were entitled to learn from that experience. They were not obliged to operate the scheme unaltered in perpetuity or until allocated funds ran out.

31. On 7 November DfES and Capita formally signed the contract for provision of the scheme and the service centre. That contract, which I have seen, replaced the agreement between Capita and DfES made on 2 June (paragraph 26). The contract drew Capita’s attention to the Data Protection Act 1998. It required that Capita must undertake to comply in all respects with the provisions of that Act in relation to all personal data collected or processed in the provision of services under the contract. The contract contained a schedule of the specific services to be provided by Capita. In respect of the criteria for registration of learning providers, the schedule stipulated that learning providers must be “currently registered with either the Further Education Funding Council, Training and Enterprise Councils, Local Enterprise Companies or with an awarding body e.g. City and Guilds or BTEC. The contractor (Capita) will need to verify this current registration with the appropriate authority”. A further prerequisite was that learning providers “must be registered on learndirect’s learning opportunities database” (paragraph 25). Those provisions were said to have commenced from 12 June 2000. No variations to that requirement were recorded in the contract. The contract also stipulated that Capita would provide a system that would authorise and earmark individual incentive payments on request from learning providers, who were required, by means of an Internet interface with the scheme’s computer system, to declare and certify the appropriate incentives for courses.

32. The contract prescribed that the service centre would process applications to open accounts, subject to the applicant fulfilling minimum eligibility criteria, and issue successful applicants with a membership card giving their account number. That service was to be measured in terms of speed of fulfilment; the contract specified that, for monthly monitoring purposes, performance would be measured against a target of 95 per cent of enquiries and requests to be dealt with within two days. [Note: DfES have told my staff that the target as publicised to learning providers was ten days; that accords with Mr Tuckett’s understanding (paragraph 84)]. As regards data security, the contract prescribed that each account would have a unique identifier which must comply with the provisions of the Data Protection Act 1998. In respect of telephone calls from account holders, the service centre was required to verify the identity of the caller before releasing any information, by confirming the contents of a minimum of two fields from a specified list of fields held on the computer system. There were no equivalent requirements in respect of learning providers. In respect of Internet access there were to be specific strategies for different communication channels, including personal identification numbers and passwords. The contract contained no specific requirement to establish security policies or procedures. As regards fraud, the only reference in the contract was in respect of the procedure for authorisation of payment of incentives to learning providers, which stipulated that “the fraud issue will be addressed by agreeing specific [management information] reports generated through data mining techniques”.

33. On 9 November the programme board considered a paper entitled “Individual Learning Accounts - Audit Requirements”. That paper said that an audit investigation of one learning provider was about to begin. The paper recorded that officials intended to make further visits to Capita to confirm that their processes were robust and that incentive claims could be substantiated. [Note: DfES officials undertook a preliminary systems audit in April 2001. That audit was not documented, but Capita described the informal feedback from it as “very positive”.] Capita had agreed to carry out checks to try to identify any potential irregularities in the claims submitted by learning providers. If irregularities were identified, DfES intended to take action to assess whether incentives had been claimed correctly, and would pursue investigative action against individual learning providers where necessary. [Note: my staff have seen no evidence as to whether those checks were carried out.]

34. 2001 On 5 January Capita’s monthly report of the service centre’s performance for December 2000 recorded that the target turnaround time for processing membership applications was that 95 per cent of applications should be processed within two days and that actual performance had been 98.19 per cent(the performance for September 2000 had been 80 per cent, October 78 per cent and November 90 per cent). The same report noted that of 209,335 application packs issued in December, 180,299 had been issued as a result of requests from learning providers.

35. On 23 January the programme board at their monthly meeting decided that in future they would review the full risk register on a quarterly basis, but would continue to review high risk areas monthly. The review of the risk register produced for that board meeting recorded that DfES were conducting a formal investigation of one learning provider in respect of possible deliberate fraud and had begun an investigation of another who appeared to be contravening the rules of the scheme. DfES also intended to conduct an audit of eight learning providers whose pricing gave cause for concern and a sample audit of other learning providers.

36. On 2 May the target of one million account holders (paragraph 6) was reached, almost a year early. Meanwhile, at the end of April, Ministers had agreed that a more coherent system of learning provider registration should be established by September 2001, with a view to improving compliance by learning providers with the scheme’s policy objectives. They agreed to introduce a code of practice, or “learning provider agreement”. The code was intended to give a clear explanation of the aims of the policy and ensure that learning providers understood the terms and conditions of their registration. However, there was no plan for DfES to undertake a system of vetting learning providers. On 10 May DfES wrote to all learning providers introducing the learning provider agreement. All learning providers were required to re-register under the scheme and sign up to the learning provider agreement by 30 June. The letter warned learning providers that if they failed to do so, their registration would cease from 14 July.

37. Meanwhile, on 9 May the programme board had agreed to include in the risk register the quality of training as a specific risk. The paper on the review of risks submitted to the programme board recorded that the trend in respect of deliberate fraud by learning providers had worsened. The paper said that DfES’s Special Investigations Unit was co-operating with the police over two cases, and another large learning provider had been asked to provide comments on DfES’s concerns over the way that they were operating the scheme.

38. On 12 May Mr A submitted his application to open an account. On 24 May the service centre processed his application form and backdated his membership of the scheme to 16 May.

39. Following the general election on 7 June and subsequent Government re-organisation, Ministerial responsibility for the scheme passed to the then Parliamentary Under Secretary of State for Adult Skills. On 29 June officials alerted Ministers to their concerns over the behaviour of a small number of learning providers. They said that registration of learning providers operated on the basis of a “light touch” and was designed to place minimal burdens on providers while offering adequate protection for public funds. However, following investigation of instances where learning providers did not appear to be following the rules of the scheme, nine learning providers had been suspended, one had been warned and a further 40 were under investigation. On 12 July the Parliamentary Under Secretary of State wrote to all learning providers to say that DfES had identified a number of unacceptable practices by learning providers, and that DfES would take firm action in respect of complaints that they received. He concluded by thanking learning providers for their involvement in the scheme and for their help in DfES’s work to improve the skills level and productivity of the workforce. On 31 July the introductory offer of £150 incentive for the first one million account holders (paragraph 7) came to an end.

40. Meanwhile, early in July 2001 the company, which Mr Tuckett intended to be a community-based learning provider to provide Internet access and basic computer training, had commenced trading. On 25 July the company wrote to the service centre enclosing a list of 57 learners who, they said, had submitted applications for individual learning account membership ten days or more previously, but who had yet to receive account numbers. Most of them had already started courses.

41. On 1 August DfES produced revised guidance on the learning eligible for scheme discounts. That guidance included a note that people could benefit from a discount only if their accounts were dated on or before the course start date. On 15 August DfES’s Workplace Learning Division wrote to learning providers to outline a number of practices which DfES had identified as unacceptable. Those were: learning starting before an individual became an account holder; failure to obtain completion of an enrolment form; failure to collect a personal contribution from individual students; and the use of aggressive or misleading marketing material. DfES said that where there was evidence that a learning provider had adopted one or more of those practices DfES would investigate, would seek repayment of any money paid improperly, and would consider removal of the learning provider from the scheme’s register.

42. On 20 August the programme board again reviewed the risks to the scheme. They noted that a much higher than expected demand in the final week of the £150 offer for the first million applicants (paragraph 7) had caused Capita’s service to suffer. They also noted that there was evidence of agencies recruiting scheme members and selling their personal details to learning providers. They proposed to recommend to Ministers that blank application forms be withdrawn. The review of risks referred to the programme board’s meeting recorded that officials were increasingly concerned about improper marketing, creative pricing and deliberate fraud, and recorded a new risk (classified as medium probability) that learning providers were not complying with the rules of the scheme.

43. On 24 August Mr Tuckett received an e-mail message which the service centre had sent to all learning providers saying that from 1 September the system would not accept bookings in respect of courses where the booking was made more than 42 days after the start of the course. On 26 August Mr Tuckett replied by e-mail asking the service centre to clarify the position in respect of learners who submitted an application form at the time they signed up for a course, and who typically started the course a week later. He said that the service centre were currently taking five to six weeks to process such applications, and asked whether the requirement to book learning within 42 days took such delays into account. [Note: DfES subsequently told my staff that an analysis by Capita showed that in all cases membership cards were issued to students and confirmed by the company before the 42 days deadline for courses to be registered.]

44. On 4 September the service centre issued an e-mail message to all learning providers saying that the service centre were experiencing unprecedented levels of demand for scheme membership, which had led to a significant increase in the time being taken to process applications (paragraph 42). They said that individuals would not be disadvantaged as all correctly completed applications that met the eligibility criteria would have membership valid from the date on which the service centre had received the application. If a learning provider enrolled a student without a membership card, any associated discount could not be guaranteed at that stage. However, if the individual subsequently produced a card that was valid before the course start date, the learning provider would then be able to register the learning and claim the associated discount.

45. Mr Tuckett replied to the service centre to ask if they could say how long they would take to clear the current backlog of applications. He said that the company had payments totalling £17,220 owing because of the delay in issuing membership numbers. He again asked for clarification of the 42-day rule. [Note: I have found no record of a reply to Mr Tuckett’s message, or to his e-mail of 26 August – paragraph 43.] On 14 September Mr Tuckett wrote to DfES complaining that, of 147 applications for scheme membership submitted by his learners, only 21 membership numbers had been issued. As a result, the company was unable to put forward claims totalling £18,460 for the incentive. Mr Tuckett said that the implications for the company’s cash-flow and ability to survive were obvious, and asked that DfES investigate the matter as a matter of urgency. [Note: I have found no record of a reply to that letter.]

46. On 18 September officials alerted Ministers that arrests made by the National Crime Squad that day might result in media coverage linking the scheme to serious criminal activity. They said that an unrelated police investigation had discovered several accounts in apparently fictitious names, and further investigations had discovered several hundred accounts from which it was suspected that incentives had been improperly claimed by certain learning providers in order to fund illegal activities. [Note: DfES have said subsequently that no evidence has been found to show that scheme funds were used to fund such illegal activities.] They recommended changes to the administration of the scheme to prevent some of the most common forms of abuse. They said that evaluation evidence indicated that the great majority of account holders were satisfied with the scheme. However, throughout the summer there had been a steady stream of press articles concerning abuse of the scheme, together with a growing body of complaints and evidence from DfES’s own investigations, all of which gave some cause for concern. Ministers agreed a number of steps to address the most pressing problems. In particular, the practice was to be ended by which accounts could be opened by means of blank application forms issued by DfES to learning providers, and registration of new learning providers was to be suspended.

47. On 25 September Mr Tuckett sent the service centre a list of 145 outstanding applications and asked if they could confirm the status of a representative sample of those applications. On 26 September he e-mailed the service centre to say that his wife had received her scheme membership number in the post the previous day, over two months after her application had been submitted on 21 July. However, her membership of the scheme had been backdated to May. On 27 September the service centre replied to say that they had checked a random sample of seven learners named on the list supplied by Mr Tuckett. Six had live accounts but there was no trace of the application for the seventh.

48. Also on 27 September the Parliamentary Under Secretary of State wrote to the then Secretary of State detailing the abuses of the scheme that had been identified and setting out the steps that DfES intended to take to tackle that abuse. He said that he had instructed officials to take forward an urgent programme of work to develop an action plan to identify the scheme’s weaknesses and rebuild the scheme. He also reported that there had been an upsurge in demand for the 80 per cent discount following the ending of the £150 incentive (paragraphs 39 and 42) and that there was a prospect of the budget for the scheme being overrun by between £20 million and £90 million. [Note: on 15 October officials put the action plan to Ministers. It recorded that the existing learning provider guidance was weak and that new guidance would be issued. The plan proposed a number of other initiatives to curb the abuse of the scheme.]

49. On 28 September DfES wrote to all learning providers saying that, with immediate effect, the service centre would no longer accept applications to open accounts unless they had been made personally and directly by individuals via the scheme’s website or by telephone, and that registration of new learning providers had been suspended for a period of three months. DfES said that, where a non-personalised application was received after 28 September, the service centre would write to the applicant informing him or her that the application was invalid and must be re-submitted by the individual. [Note: the letter to learning providers did not explicitly say what would happen to non-personalised applications received but not processed before 28 September.]

50. On 30 September Mr Tuckett e-mailed the service centre to say that he had contacted about half of his registered learners, of whom 43 had now received membership numbers, mainly in the previous week. Many of those accounts had been backdated to 9 May. He also supplied a list of ten learners who had said specifically that they had not received numbers, yet had applied between 20 July and 8 September. On 15 October Mr Tuckett sent to the service centre an updated list of 25 learners, all of whom had submitted applications between 18 July and 20 September, who had told him that they had not received membership numbers. On 17 October he sent the service centre a list of 58 learners from whom he had not yet received details of their membership numbers, including 28 who said that they had not received their numbers and a further six whom had experienced problems with their applications. All had applied on or before 20 September. Mr Tuckett asked the service centre to check the status of the applications and let him know the outcome.

51. Meanwhile, on 9 October officials had recommended to Ministers that the 80 per cent discount payable under the scheme for certain types of learning should be ended because of the upsurge in the volume of claims following the ending of the £150 offer (paragraphs 39 and 42). They had calculated that the scheme’s budget would otherwise be overspent by between £103 million and £171 million in the current financial year.

52. On 17 October DfES’s legal adviser received counsel’s opinion as to whether the 80 per cent discount could be closed down and, if so, what period of notice might be required by the rules of natural justice. Counsel advised that it lay within the Secretary of State’s powers to amend the scheme, subject to an adequate period of notice. Although there was no definite legal view on what constituted adequate notice, he felt that four to six weeks should be sufficient. The longer period would be easier to defend and if there were provision for an exception in special circumstances, that would also reduce the prospects of a successful challenge. Counsel added that it would not be possible for DfES to suspend the whole scheme without giving at least the same period of notice.

53. Ministers met officials on 18 October and decided that the scheme should be suspended.

54. On 19 October the service centre sent Mr Tuckett details of 26 students from the list he had sent on 17 October (paragraph 50). The service centre’s records showed that nine of those students had live accounts. The accounts for four others had been closed. One record was shown as “serviced” (although no explanation was given). [Note: DfES have subsequently explained that “serviced” referred to an individual application that had been received and membership issued.] There was said to be no trace of the remaining 12 applications. On 23 October Mr Tuckett replied by e-mail to the service centre. He said that the 12 applications of which there was no trace were all paper applications submitted after 13 September. As DfES had changed the rules to preclude such applications with effect from 28 September, he asked whether the service centre had simply stopped processing any backlog of paper applications. He said that there were up to ten similar applications outstanding. He also said that it appeared that the membership numbers for the eight students for whom there were said to be live accounts had gone astray. One of the students whose account had been closed had recently received a letter saying that that was because his membership number had been returned, marked “recipient unknown at address”. The student had found that strange as the second letter had been sent to his correct address, where he had lived for some time. Mr Tuckett asked whether there was a problem with the system which could result in the generation of an incorrect address. Finally, Mr Tuckett asked what was meant by “serviced” and said that the service centre had not confirmed the account status of a further three students who had confirmed that they had not received membership numbers, or of the remaining 23 students on his list. [Note: I have seen no record of any reply from the service centre to that e-mail from Mr Tuckett.]

55. On 24 October the Parliamentary Under Secretary of State wrote to all Members of Parliament saying that that he had decided that, with effect from 7 December, the scheme would cease to operate. He said that that was largely because the scheme had exceeded expectations. The scheme’s rapid growth had caused DfES to think again how best to target public funds and secure value for money. He said that he was also concerned that some people were being pressed to sign up for low value, poor quality learning, and he had decided to act quickly to protect the interests of learners and the proper use of public funds. DfES intended to write to all existing account holders between 29 October and 5 November, giving them at least four weeks’ notice of the withdrawal of the scheme. The scheme was now closed to new applications and no new accounts would be opened. However, learning undertaken by existing account holders would be supported as long as it was booked with the service centre by 7 December. In a press statement issued the same day DfES said that the programme had exceeded the Government’s expectations and had expanded beyond its capacity. The Government was also concerned by evidence of exploitation by learning providers offering poor value for money. To tackle those concerns, the Government had decided to suspend the scheme from 7 December.

56. On 31 October Mr Tuckett wrote to DfES to say that the suspension of the scheme meant that the company would probably need to close down by Christmas. He had advised all of his learners that they should attempt to complete their training in the following eight weeks. However, even that was dependent on clarification of the company’s obligations under company law. He said that the vast majority of his learners had not had scheme membership numbers when they signed on for learning, but they had been allowed to start learning immediately. Of 215 learners who had signed up, 95 were still awaiting account numbers, many dating back to applications lodged in July and August, mainly due to delays by the service centre. He asked DfES to confirm whether they would subsequently challenge the company for drawing down incentive funds if they were to close at Christmas, and whether they would be challenged for booking and confirming existing learners before 7 December if they were subsequently to close.

57. On 12 November Mr Tuckett wrote to DfES to say that 74 of his learners had not yet received their account numbers. As a result, the company was unable to claim incentive payments worth over £11,000. Mr Tuckett said that the service centre had told him that a large batch of paper applications lodged in the two weeks before the discontinuation of paper application forms on 28 September could not now be traced. He said that a further group of 12 learners had apparently had their numbers issued but had not received them. Four further accounts had been closed as the membership packs had been returned. Mr Tuckett said that he suspected that that was because they had been issued with incomplete addresses. Mr Tuckett supplied details of all outstanding applications.

58. Also on 12 November Mr Tuckett wrote to the Parliamentary Under Secretary of State saying that, as a direct consequence of the announcement that the scheme was to be suspended, the company was expected to close as insolvent on 31 December, with debts of around £40,000. Mr Tuckett said that he had aligned the company’s objectives as closely as possible with Government policy, yet the Government was pushing the company under. He asked for a meeting with the Parliamentary Under Secretary of State.

59. By Mr A’s account, in early November he received a letter saying that he must use his account before the scheme closed on 7 December. On 13 November he attended a “taster” course at a local computer training centre (which I call learning provider X) operated in association with a local college. The service centre’s records show that, also on 13 November, an unrelated learning provider (learning provider Y) accessed Mr A’s account through the Internet and registered Mr A on a European Computer Driving Licence course that had started on 29 October. Learning provider Y claimed a £200 incentive payment in respect of the course, which cost £250. On 14 November learning provider Y again accessed Mr A’s account and confirmed his registration. By Mr A’s account, on 20 November he enrolled on a Computer Literacy and Information Technology (CLAIT) stage one course with learning provider X, a course eligible for the 80 per cent discount. He paid a deposit of £23, which he expected to be his full contribution to the cost of the course. He also gave learning provider X details of his account, which he had not otherwise used. Mr A subsequently assured my staff that he had no knowledge of learning provider Y and had not undertaken learning with that learning provider.

60. On 16 November DfES replied to Mr Tuckett’s letter of 31 October (paragraph 56). They said that it had never been the purpose of the scheme to provide a source of funding for learning providers, but rather to provide learning opportunities for individuals and to attract new learners. As a direct consequence of that, the scheme had brought new business to learning providers and UK Online centres, but there could be no guarantee that the scheme would keep learning providers supplied or operating at any given level of activity. In response to the specific questions asked by Mr Tuckett, DfES said that they would not be happy if he drew down funding for learning that was subsequently not delivered, but that he should discuss that with an insolvency specialist and with the Department for Trade and Industry. They also said that, if he had applied for funding for people who had started courses several weeks previously, he had not followed the rules of the scheme, which were available on the scheme’s website, and was therefore in breach of the learning provider agreement. DfES said that learning should not be funded in retrospect and enclosed an extract from the rules of the scheme.

61. On 20 November Mr Tuckett replied to DfES’s letter of 16 November. He said that most potential learners had arrived without a membership number and had wished to start learning straight away after submitting an application. He had been told clearly by the service centre that the effective date of membership was the date on which the application form was completed. He also said that the service centre had written to say that members would not be disadvantaged by delays in processing and that applications would be logged onto the system based on the date on which they arrived at the service centre. Mr Tuckett said that the rules quoted by DfES simply said that “arrangements” must be made when the person enrolled and paid for a course. He had complied with that, and had made all arrangements in respect of scheme membership at the time learners enrolled. He asked for an assurance that membership numbers would be allocated and all outstanding queries resolved by the 7 December deadline.

62. On 21 November DfES received a complaint from a learning provider that he had been offered a large number of account numbers for sale. On 22 November officials from DfES’s Special Investigations Unit visited that learning provider, who gave the investigators a computer disk containing 1,000 account numbers and supporting account holder details, which he said had been given to him as a sample of details of 150,000 accounts which were being offered to him for sale by a named person. [Note: DfES have said subsequently that no evidence has been found to substantiate that allegation.] DfES’s analysis showed that the sample disk contained details of live accounts on which incentives could be claimed.

63. On 23 November officials reported to the Secretary of State the evidence supplied by the learning provider, saying that the security of the account holder database had been compromised and substantial amounts of public funding put at risk. The submission recommended that the only option to prevent the improper payment of substantial amounts of public money was to implement an immediate suspension of the scheme and all payments to learning providers. Officials reported that the Permanent Secretary, as Accounting Officer, had agreed that the proposed course of action was correct, that the head of DfES’s internal audit had agreed that the response was proportionate to the evidence of abuse. Advice had been sought from the Treasury solicitor on the terms in which the suspension should be framed in order to reduce the risk of legal challenge. [Note: I have seen no separate record of that advice or other record of the consultation with the Permanent Secretary and head of internal audit.] Officials said that the Special Investigations Unit would notify the police of the evidence and allegations held. On the same day DfES issued a press notice which said that the Department had called in the police to investigate alleged fraud and theft involving the scheme, and that that afternoon, as a result of irregularities discovered by DfES investigators, the scheme was shut down immediately, two weeks earlier than planned.

64. Also on 23 November, a payment was made to learning provider Y in respect of the course which they had registered against Mr A’s account. On 27 November Mr A attended the first session of his training course with learning provider X. The course administrator told him that they had been unable to claim an incentive against his account as it had apparently been fully used. According to Mr A, he telephoned the service centre that afternoon; staff told him that, as the computer was inaccessible, they were unable to access his account details, but that it appeared that somebody else had used his account number. They undertook to check and, if appropriate, reinstate his account balance. They asked him to call again at the end of the week. [Note: the service centre have told my staff that they have no record of Mr A’s telephone call, or his subsequent call (paragraph 68 below); because the system had by then been closed down, details could not be accessed and notes could not be updated.]

65. On 27 November the Parliamentary Under Secretary of State wrote to inform Members of Parliament that on 23 November DfES had called in the police to investigate alleged fraud and theft involving the scheme. Officials had confirmed evidence of serious irregularities and the scheme had been closed on 23 November. From 6.30 pm on that day all of the scheme’s computer systems, including the website, the database and the service centre’s systems, had been shut down. The Parliamentary Under Secretary of State said that DfES intended to honour all genuine bookings for eligible learning which were made before the scheme’s computer systems were closed on 23 November, and that officials were putting into place arrangements to validate outstanding claims from learning providers.

66. On 28 November the Parliamentary Under Secretary of State told a previously arranged hearing of the House of Commons Education and Skills Select Committee that it had not been possible simply to close down the small number of learning providers who had been abusing the scheme. DfES had attempted to take steps to investigate such learning providers, but the way the system operated had not proved strong enough to allow DfES to close down the operations of learning providers they suspected had been abusing the scheme. The Parliamentary Under Secretary of State said that he was unable to use public money to support the operations of learning providers who had run into difficulties as a result of the closure of the scheme.

67. On 29 November the Parliamentary Under Secretary of State wrote to all registered learning providers saying that the scheme had been closed from 23 November because of allegations of fraud and theft. That decision meant that the scheme was closed to further booking of learning by account holders and learning providers. However, subject to validation, incentives would be paid in respect of all learning that had been notified to the service centre before the computer system was closed. DfES had also placed on the scheme’s website guidance about the closure of the scheme and DfES’s proposals for dealing with outstanding payments.

68. On 30 November Mr A contacted the service centre again. By his account, a named officer told him that the scheme had been closed and that his course would therefore not be funded. Mr A later told my staff that he had then reached an agreement with learning provider X under which he would pay a further £23 to enable him to undertake his chosen course, although that did not meet the full price normally charged by learning provider X for the CLAIT stage one course.

69. Also on 30 November Mr Tuckett met the head of DfES’s Workplace Learning Division. DfES’s record of that meeting notes that Mr Tuckett explained how the closure of the scheme had left the company with serious cash-flow difficulties, which meant that the closure of the company was by then inevitable. He said that the withdrawal of the scheme had destroyed the company’s business plan and its ability to raise additional funding. He was seeking compensation from the Government for what he believed to be contractual default, breach of duty of care, and maladministration.

70. On 6 December Mr Tuckett sent to the service centre a claim for payments of £8,380 in respect of 55 learners who had registered for his courses and applied for account numbers. In most cases the account number had either not been issued, or had not been received by the learner before the closure of the scheme. However, in four cases the learning had been booked, but not confirmed, on the system on the afternoon of 23 November. In one other case the company had been unable to book learning on the afternoon of 23 November before the closure of the scheme at 6.30 pm, because, Mr Tuckett said, the system was becoming unstable.

71. 2002 On 15 January, in response to a general enquiry from my staff about the closure of the scheme, DfES said that the scheme had been closed without retrospection on 23 November and that no further learning could be funded through the scheme. They said that investigations were continuing into some 5,120 complaints in respect of accounts being used without the account-holder’s knowledge. [Note: DfES have subsequently told the Ombudsman that, as a result of follow-up by their Compliance and Special Investigations Units, some 20,000 learners have been identified who have indicated that their accounts were used without their consent.]

House of Commons Education and Skills Select Committee Inquiry

72. On 16 January the House of Commons Education and Skills Select Committee announced that they intended to carry out an inquiry into the scheme. The terms of reference of that inquiry were to examine the lessons learned from the closure of the scheme, with particular reference to management, policy and plans for replacing the scheme. The Select Committee published their report on 1 May[4]. I have studied the report, minutes of evidence, and memoranda included in the minutes of evidence, which has greatly assisted my investigations. I draw on that published material in paragraphs 73 to 77 below.

73. On 23 January the Select Committee examined officials from DfES responsible for the design of the scheme and for managing its closure. The officials acknowledged that one of the reasons for the closure of the scheme was that the service centre had received an increasing number of complaints from students who had tried to use the money in their accounts, but had found that the money had gone. The officials said that the scheme had been designed to be simple and non-bureaucratic in order to build up the demand for learning. It had also been intended to widen the base of learning providers rather than to rely on public sector colleges or a shortlist of established private sector providers. However, they acknowledged that that had led to difficulties in that there had been no quality assurance procedures. Because of the way the scheme had been set up, it had been extremely difficult to stop learning providers who were determined to exploit the scheme from doing so. The scheme had not been robust enough to deliver value for money or to protect the interests of learners. The scale of the suspected abuse had increased over the summer of 2001. As a result of that, DfES had taken steps to tighten up the rules of the scheme and had introduced the learning provider agreement, but those steps had not been sufficient to stop the abuse that was emerging.

74. Mr Tuckett appeared as a witness at the Education and Skills Committee’s hearing on 23 January. He said that as a result of the closure of the scheme, the company had gone bankrupt. He was concerned that, although he had signed a learning provider agreement, the Parliamentary Under Secretary of State had repeatedly said that there was no contractual agreement between DfES and learning providers. He was aware that hundreds of people had already lost their jobs as a result of the closure of the scheme. A particular sector of the training industry had been “decimated” by the closure of the scheme. Concerning the events leading to the closure of the scheme, he said that the level of security in the service centre’s computer system had been “pitifully low”. He felt that it had been a serious weakness that access to account details could be obtained simply by entering a ten-digit number rather than an alpha-numeric combination, and without cross-referencing to the account-holder’s surname.

75. Another learning provider told the Committee that it had been possible for any registered learning provider to gain access to Capita’s computer system, enter a reference number, find an unused account and draw down the funds from that account without any further checks being made.

76. On 13 February the Select Committee examined executives from Capita. The executives said that Capita had developed, implemented and operated the computer systems for the scheme, had administered defined elements of the scheme’s business processes, and had advised DfES on operational and technical issues. They had provided call centre operations for account holders and learning providers, and a computer processing centre. On 23 November 2001 DfES had told Capita of a suspected breach of their computer system. Capita had co-operated fully with DfES and the police and had closed down the service centre immediately at DfES’s request. Capita’s subsequent investigations had not identified any breach of security or “hacking” of the system, and they had found no evidence of illegal activity by any Capita employee. What they had found was evidence of abuse of the system by a few registered learning providers. Throughout the operation of the scheme, Capita had advised DfES of a number of issues about actual and potential inappropriate use of the scheme. It had been very much an incremental process as things had come to light and Capita had tried to work with DfES to introduce changes. There had been some major changes in process as the scheme closed. Capita confirmed that they had been responsible under the contract for the original design of the registration process for learning providers, which had then been signed off by DfES. However, they were working to a brief agreed by DfES in terms of the requirements for information from learning providers. At the early stages of the design brief it had been intended that there should be a validation process for learning providers, but that had not gone ahead for various reasons, including concerns that it might discourage new learning providers from entering the marketplace. Capita said that, at the time the scheme’s computer system was developed, they were working to a specification which assumed that the learning provider would have been accredited previously. The level of security in the scheme’s computer system was built around that understanding. Once inside, the scheme was very open. Eventually it became apparent that some of the users were not entirely bona fide and had possibly abused the scheme. Capita accepted that when that came to light they should have either closed the system or taken action to make it more robust. Access to the details of individual account holders had been controlled only by means of their account numbers, which were simply reference numbers. Capita found that some registered learning providers had accessed the system many times and had extracted names and addresses from the system.

77. On 26 February the Select Committee re-examined the Parliamentary Under Secretary of State and senior DfES officials responsible for the operation of the scheme. They told the Committee that, before the design for the scheme had been finalised, DfES had considered the extent to which the scheme could be integrated with thelearndirect national database of learning opportunities (paragraph 25), membership of which involved a registration process requiring some basic information about learning providers. DfES had hoped to be able to provide a direct link between the scheme’s computer system and that of learndirect to provide a better information service to customers. The link with learndirect had been retained in the contract between DfES and Capita signed in November 2000, but had not proved possible because of data incompatibility. However, it had not been the intention to use the link with learndirect to provide accreditation for the scheme; it was not learndirect’s function to provide quality assurance.

Further developments

78. On 19 April 2002 DfES wrote to a company, which they believed to be the parent company of learning provider Y, saying that in January they had appointed a firm of auditors to undertake factual enquiries about the operation of the scheme by the parent company and a number of associated learning providers. DfES had considered the information that those bodies had supplied to the auditors, but were not persuaded that a claim for a substantial further amount of funding under the scheme was valid, or that the providers were entitled to payments of funding from the scheme that had already been made to them. DfES gave a number of reasons why they intended to withhold payment of the claimed funding and possibly require repayment of incentives already claimed, and asked the parent company to submit further evidence to support their claims for incentives under the scheme.

79. On 20 May my staff asked Mr Tuckett to provide a definitive list of those students for whom he believed account numbers were outstanding. On 6 June Mr Tuckett provided details of 51 learners for whom he had either not received numbers, or had received them too late for their learning to be booked onto the system. [Note: Mr Tuckett omitted four of the original 55 learners he had written to the service centre about on 6 December 2001 (paragraph 70) as DfES had indicated that they intended to honour payments for learning booked but not confirmed prior to closure of the scheme.] Mr Tuckett said that the company had lodged applications for account numbers on the day that the learners had applied to join. He could not be entirely certain that all of the learners listed had not received their account numbers, but in most cases they had been extremely helpful and diligent in pursuing the service centre when the company had asked them to do so during November 2001. In many cases learners had received evasive answers; in some, numbers had been posted to an incorrect or incomplete address, and there had been cases where the service centre had admitted destroying the applications.

80. In response to a request from my staff for information about those 51 applications, DfES provided an initial analysis from the service centre’s record which suggested that account numbers had been issued to 20 learners before the suspension of the scheme. Two accounts were recorded as closed because letters addressed to the applicants had been returned to the service centre. The service centre said that they had found no live records in respect of a further nine applications. However, they were able to provide copies of those application forms. In respect of a further 17 applications, all of which were submitted after the use of blank paper application forms was withdrawn on 28 September 2001, DfES provided copies of Mr Tuckett’s own form which he used to confirm that the learner had paid a deposit, but no other information. Mr Tuckett subsequently confirmed that membership numbers in respect of eight of those students had been received after 23 November, but that a further nine remained outstanding. DfES provided no information about a further three applicants.

81. On 26 JuneDfES published their response to the report of the Education and Skills Select Committee (paragraph 72). They said that they had received 5,120 complaints in respect of funding having been removed from accounts without the account holder’s knowledge or consent. DfES accepted that it seemed that learning providers had been able to trawl the computer system to access account information for which they did not have authorisation and had subsequently been able to submit incentive claims. In response, DfES had closed the scheme. DfES included as an annex to their response to the Committee a special review that had been requested by the Secretary of State and Permanent Secretary to identify key lessons learned from the development, introduction and operation of the scheme. That review, carried out by DfES internal audit, included among its findings:

All major decisions on the shape and direction of the scheme were taken with the agreement of Ministers. However, it had not been possible to identify when and how some operational decisions were arrived at, including the establishment of a “buyer beware” system with no central checking of learning provider viability or quality, and the decision to encourage the widest possible range of learning providers rather than relying on existing provision from colleges and work-based providers.
A significant minority of learning providers had engaged in aggressive marketing and mis-selling in order to maximise their income from the scheme, and many complaints were received in respect of poor quality provision of learning.
The project team were under severe time pressure, which substantially contributed to problems experienced in developing the scheme.
No business model was developed to assess the strengths and weaknesses of available policy options.
No decision log was set up to track decisions.
Although a great deal of management information was collected by Capita it was not provided for DfES in a sufficiently helpful format to indicate possible abuse of the scheme by learning providers. DfES may not have reacted quickly enough to some information received.
Although a risk register was in place and reviewed regularly, there was insufficient evidence of active, ongoing management of each risk by a nominated team or individual outside the programme board’s meetings.
Commenting on the lessons to be learned for future risk identification and management procedures, the audit review said that all policy developments should consider the risk and implications of fraudulent and improper activity. For future contracting and contract management arrangements there was a need for absolute clarity in respect of data security requirements in DfES’s contracts and provision should be made for the rigorous testing of security arrangements.

82. DfES also included in their response to the Select Committee a synopsis of a detailed report by a firm of specialist consultants into the security of the computer systems operated by Capita in respect of the scheme. That report found that:

The contract between DfES and Capita was for the delivery of the scheme, not for the delivery of a computer system. The requirements detailed in the contract made no clear mandates or stipulations regarding the assessment of security requirements or ongoing security management. As a result, no security policies or procedures specific to the scheme were developed.
No requirement was specified with regard to the determination of security requirements, nor were existing Government guidelines regarding security risk analysis followed.
Security management of the system was incorporated into Capita’s existing security management functions rather than as a separate function within the management of the scheme structure; that had proved to be unsuitable.
No structured mechanisms and procedures had been established to identify promptly trends and patterns of access and usage of the system that might indicate abuse.
No procedures had been established to ensure that the requirements of the security policy were adhered to.
No plans had been established for ongoing testing of the system to ensure that security provision was adequate.
No procedures had been established for the archiving of relevant log files for later analysis.

The report concluded that no evidence of unauthorised access to the computer system by external third parties had been found during the course of the security investigation.

Interview with Mr Tuckett

83. Mr Tuckett told my staff that he had established the company as a non-profit making, community-based service providing Internet access and basic computer training. He had initially looked for funding from various sources which promoted community ventures, including the local authority, but those had not proved helpful. In March 2001 he had seen a leaflet promoting the scheme and, following enquiries of DfES and the service centre, had based his future business plan largely on the incentives for computer training that were payable under the scheme. At that time he had expected the scheme to last for two or three years in its initial form and that any successor scheme would operate on similar lines. Mr Tuckett had recognised that there was a huge unmet demand for the type of community-based training that the company could provide. He had obtained the sponsorship of a local backer and the company had started operations in July 2001.

84. Mr Tuckett said that, in their initial marketing material, DfES had said that the service centre expected to issue account numbers within ten working days of receipt of a completed application form. However, from the outset the company had experienced problems with the registration of learners. The company had sent learners’ completed application forms to the service centre on a daily basis. By the end of July there had been a long list of learners without account numbers. He had received no replies to his complaints about the situation (paragraphs 40 and 45). By the end of September, Mr Tuckett had established that 24 learners had definitely not received account numbers; the position in respect of a much larger group remained uncertain. The company had continued to pursue enquiries with learners and the service centre right up to and beyond the closure of the scheme. The administrative effort which all the checking and chasing entailed for the company had been a significant burden.

85. Mr Tuckett said that from the outset it had not been entirely clear whether the rules of the scheme had required that learning providers should wait to receive learners’ account numbers before allowing them to start learning. However, the service centre helpdesk had told him that the relevant starting date was the date the application form was completed (although the service centre had subsequently said that the valid date was the date they received the application form - paragraph 44). The company had accepted that it carried the risk if forms were incorrectly completed or students were ineligible for incentives.

86. Mr Tuckett said that the key risk to his business had been the cash-flow problems caused by the service centre’s tardiness and ineptitude in processing applications for account numbers. The company’s costs in the early stages were between £7,000 and £8,000 per month, while income should have been between £6,000 and £9,000 per month. By the end of September 2001 the backlog in payment entitlement, in respect of learners who had applied for but not received account numbers, had risen to over £17,000 (paragraph 45). That shortfall was critical and had caused his business sponsors to lose confidence in the company.

87. Mr Tuckett said that the service centre had failed to reply to a number of enquiries about the rules and operation of the scheme. In particular, they had not explained how they would implement the rule requiring learning providers to register learning within 42 days of the start of that learning, when account numbers were not being issued within 42 days. He had also written to ask for clarification of the rules on the provision of computer hardware. In other instances, even though the service centre had answered his queries, those answers had been slow in coming and on occasions evasive. As to the advice provided by DfES following the closure of the scheme, DfES had eventually said that they would pay in respect of learning booked between 21 and 23 November but not subsequently confirmed. However, that did not help in respect of cases where learning could not be booked because the system had been unavailable for long periods.

88. Mr Tuckett said that he had not quantified precisely his and his company’s losses. He had lost his job, and his own and his sponsor’s financial stake. That loss was irretrievable as the company could not simply start trading again if the scheme were resurrected. The outstanding incentive payments in respect of 51 learners who had not received registration numbers were worth some £8,000. In addition, the company had wasted effort and resources dealing with what he found to be a hopelessly inefficient bureaucracy. He suspected that, while fraud and abuse in the form of mis-selling and poor quality learning had played a part, the real reason for closure of the scheme was that costs had overrun to an extent unacceptable to the Government.

89. Mr Tuckett later told my staff that ten of the 51 learners had either withheld their number from him (one of whom had completed a substantial proportion of her course), had withdrawn from the course or had attended very few training sessions other than the “taster” session at which they had registered and submitted their application for scheme membership. However, the other outstanding applications had been submitted correctly and incentive payments were properly due. He was aware of difficulties over several of the applications, either because there were questions over the learners’ eligibility for the scheme or because there were queries over addresses or dates of birth. However, in one case, the service centre had cancelled an application apparently on the basis of an incorrect or incomplete address. Mr Tuckett pointed out that one version of the application form had required only the first line of the address and the postcode.

90. Mr Tuckett also subsequently told my staff that he had calculated that by the end of September 2001 the company was awaiting some £20,000 worth of incentive payments, whereas had the service centre issued membership numbers within the ten days he had been led to expect, that figure would have been closer to £7,000. That had left the company with a substantial shortfall. The company’s major sponsor had declined to meet that additional financing requirement and had effectively withdrawn all future funding. Mr Tuckett said he was convinced that had the requirement been for only £5,000, as would have been the case had membership numbers been issued on time, the sponsor would not have withdrawn that funding. The outcome for Mr Tuckett personally was that he had not been paid either his salary of £14,900 from March to December 2001, or a contractual termination payment of £9,600 that had become due when the company closed.

Interview with Capita

91. The Ombudsman’s staff interviewed representatives of Capita about the security measures that Capita had operated in respect of the scheme and, in particular, any measures designed to protect the scheme’s computer system. Capita said that they had designed the system on the understanding that learning providers would be required to be registered as learning providers with learndirect. Capita understood that to mean that learning providers would have been required to establish that they were bona fide businesses, with established premises, insurance cover and bank accounts, and who could therefore be placed in a position of trust as members of a closed, accredited community of learning providers under the scheme. Capita said that DfES had deferred the requirement for learning providers to be registered with learndirect very shortly before the scheme became operational in September 2000, because that requirement was seen by learning providers as a barrier to entry.

92. Capita said that access to the computer system had been protected by means of the requirement for authorised users to input a valid username and password. That had been totally successful, and subsequent investigations had confirmed that there had been no incidence of unauthorised access to the system. Once authorised learning providers had accessed the system, they had legitimate access to specific functions. Before they could access a learner’s details they were required to enter the learner’s account number, which was validated by means of a check digit (although that had not been intended to be a security measure). Entry of a valid number brought up the learner’s surname. However, if an account had been fully used, the system would not provide any details but would return an error message. To obtain a learner’s full details the learning provider had to record that they wished to book an episode of learning, which would give access to the learner’s name and address and confirm the maximum amount of incentive funding available.

93. Capita said that it had been a requirement of the contract that learning providers would be required to access the scheme’s computer system by means of the Internet to certify learning and input claims for incentives. Capita had been concerned that it would be unusual and inappropriate for the person who stood to make material gain to be responsible for inputting the claim on the computer system. However, DfES had been clear that that was how they expected the scheme to operate. In retrospect, Capita identified the fact that learning providers had been allowed to input their own incentive claims, without any cross check that learning had actually been provided, as a major weakness in the original design of the scheme.

94. Capita said that, other than the username and password, there had been no additional security measures built into the system to prevent authorised users from accessing account details where they did not have the learner’s authority. They had not considered the possibility of learning providers using the system being required to cross-reference the account number with the account holder’s surname, as had been suggested by Mr Tuckett in evidence to the Select Committee (paragraph 74). The system had been designed on the basis that authorised users were in a position of trust, in accordance with the specification and business rules for the scheme. DfES had not formally signed off the computer system, as the contract specified only outputs and it was for Capita to provide the means to produce those outputs. However, DfES had been shown details of the system before the scheme became operational and had not raised any concerns over security. DfES had subsequently undertaken a preliminary systems audit (paragraph 33).

95. Capita said that they had always had the facility to identify inappropriate use of the system. Had the scheme not been closed down during November 2001, the next monthly report would have contained data on misuse of the scheme that month. Before that, it had been possible to identify abuse from trend-analysis of the weekly payment reports which they sent to DfES, which had proved to be an effective way of identifying discrepancies. However, there had been no specific requirement under the business rules of the scheme for Capita to identify high-claiming learning providers.

96. Capita said that, in respect of the more general abuse of the scheme, they had raised concerns with DfES on at least ten occasions. DfES had taken action in respect of some of those concerns but not others. Capita said that it was unfortunate that they had not been represented on the scheme’s programme board, as was now standard procedure in respect of public-private partnerships, and had had no input into DfES’s risk management procedures.

National Audit Office Report

97. On 25 October 2002 the National Audit Office (NAO) published a report into their investigation of the scheme.[5] NAO examined three issues:

how far the scheme met the policy objectives;
how well DfES managed risks in the design and implementation of the scheme;[6]
how well DfES handled the closure and wind-down of the scheme.

98. NAO concluded [7] that the scheme represented innovative policy-making which had attracted considerable new interest in learning, particularly in IT. However, the scheme had had to be withdrawn due to a variety of factors, including:

pressure to implement the scheme quickly, with inadequate planning;
risks in the design and implementation of the scheme which were not actively managed. The value of individual transactions was low and initially DfES had considered the risk of fraud to be low;
the relationship between DfES and Capita which did not operate effectively as a partnership. Capita were not involved in the programme board and DfES left Capita to implement the system. In adopting a public-private partnership approach, DfES had sought to comply with best practice at the time;
inadequate monitoring by DfES of the information supplied by Capita and the escalating demand for accounts. DfES did not require Capita to carry out spot checks on the eligibility of learning or basic validity checks to ensure the bona fides of learning providers.

99. NAO said that it was unclear whether Capita had fully understood the potential for fraud.[8] Their bid had acknowledged the need for rigorous security procedures to ensure data programmes and documents were secure from unauthorised access, and to ensure the design of the system was robust, with minimal chance of fraud or collusion. Capita had subsequently told NAO that their own investigations had revealed no specific evidence of unauthorised access to the system by external third parties. However, a small number of learning providers had made inappropriate use of the system. NAO noted that consultants appointed by DfES to provide expert advice on policy development, contract development and programme management had identified in July 2000 the need to test the robustness of Capita’s security arrangements and proposed learning provider password security arrangements, but there was no record of DfES having undertaken those tests or having commissioned others to do so.[9]

DfES’s response to Mr A’s complaint

100. In his initial c