Dated IT infrastructure leaves government department open to cyber risks

The parliamentary group said the department has one of the “most significant” legacy IT challenges across government as it still uses a raft of outdated applications.

“While Defra is making good progress in tackling its most urgent legacy systems it does not have a long-term strategy for its much-needed wider digital transformation,” the PAC warned.

Defra systems are used by a wide range of customers and are critical to the country’s trade, disease prevention, flood protection, and air quality monitoring.

But its customers are often forced to rely on paper forms or documents and IT systems that feel outdated and difficult to use.

Defra and its organisations handle around 14 million transactions per year that still involve paper forms, which makes them inefficient and expensive. Furthermore, it does not measure the cost to users of its unmodernised digital services, so it is not possible to assess the total burden they place on other organisations and the wider economy.

Defra estimates that it needs to spend £726m on modernising legacy services between 2021 and 2025 and that fully transforming its digital systems could save £20m to £25m every year.

It is also undertaking a business transformation process which includes potentially major structural changes to the department and its arm’s-length bodies. However, without a vision of how it will operate after this process has been completed, any changes made to its digital systems may not be appropriate once longer-term decisions about the structure have been made.

“This may lead to unnecessary time and money spent implementing these changes. Defra is struggling to recruit the digital, data and technology staff it needs, and so it remains over-reliant on contractors which can cost up to twice as much,” it added.

The Central Digital and Data Office (CDDO) at the Cabinet Office is currently working with departments to ensure that at least 50 of the 75 highest priority customer services across government reach a “great” standard by 2025.

The Office has reviewed nine of these services but only one of these meets this standard.

“CDDO’s attempts to establish strong cross-government collaboration and agree challenging commitments to replace legacy systems within departments are positive steps towards improving digital services more widely. Despite its confidence that it can meet its commitments by the 2025 deadline Defra’s current plans do not show how it will do so,” the PAC said.

Sir Geoffrey Clifton-Brown, deputy chair of the committee, said: “Defra’s IT systems are so outmoded and disconnected – where they exist at all instead of paper forms – that in some cases the professionals who keep our food, water and air safe have been forced to buy obsolete equipment just to fill in the forms to fulfil their regulatory responsibilities.

“We are facing down rapidly spreading animal diseases, maybe the next pandemic, with systems that may rely on moving paper forms around. This cannot continue.”