Scottish Government

Sector

POLICE

Summary

The police sector comprises Scotland's eight police forces, the Scottish Crime Squad and the Scottish Criminal Records Office.

Independent assessment of these organisations' readiness for the Year 2000 was carried out by Her Majesty's Inspectorate of Constabulary in Scotland.

The colour coding for the police sector at 30 September 1999 is "BLUE", except for one force which is "amber," with the possibility of it achieving "blue" by mid-late October 1999. (See comments in relation to Tayside Police overleaf).

Scope and Depth of Assessment

Scope: Central Scotland Police, Dumfries and Galloway Constabulary, Fife Constabulary, Grampian Police, Lothian and Borders Police, Northern Constabulary, Strathclyde Police, Tayside Police, the Scottish Crime Squad and the Scottish Criminal Records Office (SCRO).

Depth: The assessment focussed on five main business critical areas which had been agreed between forces and the responsible body prior to assessment. These were - Command and Control systems, the Home Office Major Enquiry System (HOLMES), SCRO, Communications and Business Continuity Planning.

The Scottish police have agreed a definition of each of the processes necessary to provide a policing service to the public over the millennium. Forces and other organisations continue to develop business continuity plans, which will assure service provision. All have now documented these plans and testing to various degrees has taken place. The detail and testing of these plans will continue to be monitored by the assessors.

Other activity undertaken by police organisations prior to and during the assessment period are referred to in the paragraph on Assessment Process below.

Method of Assessment

Independent Assessment

Independent Assessor

Her Majesty's Inspectorate of Constabulary in Scotland

Assessment Process

Millennium preparations began in all organisations in the police sector prior to the commencement of the assessment period. Initial focus was on the compilation of inventories and testing and remediation work on IT and embedded systems. All organisations also identified risks posed by elements of the supply chain and failure in the wider infrastructure and took action to reduce these. Potential changes in the demand for services and the potential impact of a greater incidence of abnormal and offending behaviour were recognised and contingency and resourcing plans have been drawn up to reflect this.

Her Majesty's Inspectorate of Constabulary carried out the independent assessment of the police sector as part of a thematic inspection of the sector's readiness for the Year 2000. The inspection covered the full range of activities involved in the provision of a police service over the millennium period and comprised pre-inspection visits followed by formal inspection visits to each force. A full day pre-inspection took place in mid-April, a second similar visit in late May/early June and a formal inspection visit carried out by the Assistant Inspector of Constabulary for Scotland, Mr Graham Power, at the end of June. Each visit was documented and Chief Constables notified of emerging findings, which included the organisation's colour coding at that time. The assessment was carried out according to the criteria established by Action 2000 with a particular focus on the critical systems agreed nationally between forces and the responsible body.

By the time of the National Infrastructure Forum meeting on 13 July 1999, all Scottish forces, the Scottish Crime Squad and the Scottish Criminal Records Office were "amber" in terms of the Action 2000 criteria. Areas which required further action or development in order to achieve "blue" status were identified and between July and September, forces and other organisations have continued to supply HMIC with evidence of the action being taken to reduce risk to this level. Colour codings were re-assessed on this basis and by 30 September all organisations were "blue" with the exception of Tayside Police. This force remained "amber" with the prospect of achieving "blue" after some residual risks are eliminated. Details are given in the Final Results paragraph below.

The Millennium Operating Regimes of organisations were not assessed in terms of colour coding but they were examined. These documents set out the arrangements in each organisation showing how operation over the millennium period will differ from "business as usual" or arrangements for a "normal" New Year period.

After September will follow a monitoring phase during which contact will be maintained with organisations and any changes affecting an organisation's operating regime will be considered in terms of risk. The importance of active change management has been highlighted to all organisations to prevent the introduction of risks which may impact upon an organisation's colour coding.

Initial Results (as at 7.05.99)

An initial assessment of the sector was carried out on 7 May 1999 following inspection visits in April and May. Initial results were as follows:

Central Scotland Police was found to be making good progress towards millennium compliance and the Year 2000 project was being well managed within the force. Scheduled work in a number of key areas was still to be completed and the force was assessed as "amber."

Dumfries and Galloway Constabulary was found to be making good progress towards millennium compliance. The force was encouraged to give more impetus to inter-agency and business continuity planning at this time and with scheduled work in a number of key areas still to be completed the force was assessed as "amber."

Fife Constabulary was found to be making significant progress at this early stage to wards millennium compliance. The few remaining tasks to be completed were being progressed on a planned and timeous basis. The force was assessed as "amber" at this time.

Grampian Police was found to be making good progress towards millennium compliance with a well resourced project team. Particular attention was being given to business continuity planning at this early stage and a considerable amount of IT work was underway. Scheduled work in a number of key areas was still to be completed and the force was assessed as "amber."

Lothian and Borders Police was found to be making steady progress towards millennium compliance with preparations for IT work in hand. The force was encouraged to develop its business continuity planning and was assessed as "amber" at this time.

Northern Constabulary was found to have a well managed Year 2000 project and was making good progress towards millennium compliance. Scheduled work in a number of key areas was still to be completed and the force was assessed as "amber".

Strathclyde Police was found to be making good progress towards millennium compliance with a number of key areas moving towards completion. The force was assessed as "amber".

Tayside Police was found to have made some initial progress towards millennium compliance. The main issue the force required to address was the significant risk presented by the planned implementation of a new Command and Control system in the last quarter of the year. With no rigorous testing plans in place and with no documented contingency plans to address this risk, the force was assessed as "red".

Scottish Crime Squad was found to have identified associated risks and was in the process of taking appropriate control measures. With scheduled work in a number of key areas still to be completed, the Squad was assessed as "amber".

Scottish Criminal Records Office was found to have undertaken good work to ensure millennium compliance. There were concerns that plans for a new disaster recovery for the criminal history system after June could not be confirmed. Due to the high risk that this presented to the criminal justice system, this was highlighted as a priority area for attention and SCRO was assessed as "amber".

The colour coding for the police sector at 2 July 1999 was "AMBER".

Central Scotland Police was subsequently assessed as "amber". The force was progressing towards achieving low risk status and testing of critical systems was planned for July and August.

Dumfries and Galloway Constabulary was subsequently assessed as "amber". The force was progressing towards achieving low risk status and testing of critical systems was planned for July and August.

Fife Constabulary was subsequently assessed as "amber". Progress had been made towards achieving "blue", primarily as a result of good project management.

Grampian Police was subsequently assessed as "amber". The force was progressing towards achieving low risk status and testing of critical systems was planned for August.

Lothian and Borders Police was subsequently assessed as "amber". The force was progressing towards achieving low risk status and testing of critical systems was planned for July and August.

Northern Constabulary was subsequently assessed as "amber". The force was progressing towards achieving low risk status and testing of critical systems was planned for early September.

Strathclyde Police was subsequently assessed as "amber". The force at that time had not decided whether their Command and Control and HOLMES systems were to be tested in the live force environment although good progress had been made in regard to business continuity planning. The force's intentions in respect of testing would be critical to their final assessment.

Tayside Police was subsequently assessed as "amber". The force was progressing towards reducing risk, although its IT strategy, partly due to timescale, carried a higher risk than normal. A new Command and Control system was planned for October as its existing system was not Year 2000 compliant, although the force did not intend to test the new system in force. Due to the force's testing strategy, the timing of the new system's introduction and the absence of a tested contingency, the force was assessed as "amber" with no prospect of achieving "blue" prior to September 1999.

Scottish Crime Squad was assessed as "amber". The squad was progressing towards low risk status and testing of its (non-critical) systems was planned for July.

Scottish Criminal Records Office was assessed as "amber". The component parts of the criminal history system had been tested and found to be compliant, while a disaster recovery system was planned for July. Good progress was being made towards achieving low risk status.

Across the sector, police radios were believed to be solid state technology with no date processing functions and verification statements to this effect had been requested as had compliance statements in regard to telephony.

All forces and the Scottish Crime Squad were encouraged to participate in end to end testing with SCRO to reduce risk as far as possible in respect of this critical system and this was arranged for July.

Final Results (as at 30.09.99)

The colour coding for the police sector at 30 September 1999 is "BLUE" with the exception of one force which is "amber" with the possibility of achieving "blue" by mid-late October 1999. (See comments in relation to Tayside Police below).

Central Scotland Police has tested its command and control system, upgraded and tested HOLMES and conducted end to end testing with SCRO, showing a high degree of attention to its IT and communications. The force has a disaster recovery system in place for its key systems and continues to develop its business continuity plans. The force is assessed as "blue."

Dumfries and Galloway Constabulary has tested its command and control system, upgraded and tested HOLMES and conducted end to end testing with SCRO, showing a high degree of attention to its IT and communications. The force has a disaster recovery system in place for its key systems and continues to develop its business continuity plans. The force is assessed as "blue."

Fife Constabulary tested its command and control system, upgraded and tested HOLMES and conducted end to end testing with SCRO, showing a high degree of attention to its IT and communications. A well developed risk register was a feature of the force's business continuity planning. The project was particularly well managed which contributed to timeous completion of tasks and well evidenced risk reduction. The force is assessed as "blue."

Grampian Police tested its command and control system and HOLMES and conducted end to end testing with SCRO in August. This force paid a particularly high level of attention to business continuity planning and the plans in place reflect the force's existing expertise in the field of emergency planning. There is evidence of good inter-agency work, exercises and contingency planning. The Year 2000 project was well resourced and managed. The force is assessed as being "blue."

Lothian and Borders Police completed testing of its command and control system and HOLMES in July and end to end testing was conducted with SCRO in August. The Year 2000 project as a whole was well managed with a high level of commitment shown by staff at all levels. The force's approach was particularly positive in respect of its IT systems testing. The force has the distinction of policing the Hogmanay street party in Edinburgh city centre which itself places high demands on the force in terms of planning and resources.

Detailed plans are in place however, which show the force's ability to deal with the extra demands and risks posed by millennium issues and the force is assessed as "blue."

Northern Constabulary completed its testing of business critical systems in September. A minor difficulty had been encountered during end to end testing with SCRO in August and this resulted in a further test being carried out in September. This tested the end to end process between the force and the SCRO back-up system and proved successful. The force has shown evidence of good inter-agency work and emergency planning and appropriate business continuity plans are in place. The force's Year 2000 project was particularly well-managed with enthusiastic and committed staff who showed a high level of awareness of the relevant issues. The force is assessed as "blue."

Strathclyde Police tested all its business critical systems and has well developed contingency plans in place as part of its business continuity planning. The project team faced particular challenges due to the size and complexity of the force and demonstrated management skills to meet these challenges in a well ordered and positive manner. The role played by divisional and departmental staff in the development of their own continuity plans made a significant contribution to the project which was well driven and co-ordinated from the centre. The force is assessed as "blue".

Tayside Police has made significant progress since the July assessment. After taking delivery of HOLMES 2 earlier this year, the only Scottish force to do so, the system is reported to be operating well within the force and has dealt with a number of live incidents. The force has stated its intention to carry out Year 2000 testing of HOLMES 2 and end to end testing was successfully completed with SCRO in August.

Business continuity plans have been developed by the force but completed versions have yet to be assessed.

The force is currently in the process of implementing a new command and control system with a scheduled go-live date of 17 October 1999. This co-incides with the completion date for the force control room project which will also see the introduction of a new call handling process. Following the recruitment of new staff, training is currently underway and a number of other applications are due to go-live after October. A contingency plan involving the use of the force's existing system has been developed as a fallback position in the event of non-delivery or failure of the new command and control system. While this has significantly reduced the risk associated with introducing the new system, residual risk remains through the amount of activity and change which the force's IT strategy has produced during such a critical and demanding period.

Concerns regarding strategy are also reflected in the force's overall approach to its millennium preparations which did not always display the same strength of project management which was evident in other organisations. As a result of these concerns, a further inspection visit will take place on 18 October 1999 to enable a further assessment to be made. Although the remaining risks are not considered to be severe, HMIC grades the force as "amber" until this final assessment.

Scottish Crime Squad does not operate a command and control system nor its own HOLMES system. Successful end to end testing with SCRO took place however and testing of non-critical IT systems was carried out. Squad managers showed awareness of Year 2000 issues and have taken appropriate action to reduce the level of risk to service provision by their staff. Contingency plans have been put in place resulting in the Scottish Crime Squad being assessed as "blue."

Scottish Criminal Records Office has conducted testing of all its systems. The Criminal History System has been made compliant and an off-site disaster recovery system is in place which provides forces with a fall-back position in the event of failure of the main system. Testing of SCRO related equipment has also taken place in forces. Full compliance was deemed to be dependent however upon end to end testing between forces, the Scottish Crime Squad and SCRO and this testing was completed on 23 September 1999. Details of resourcing arrangements to maintain service provision over the millennium period were then provided by SCRO managers which resulted in SCRO being assessed as "blue."

Conclusions

The sector has approached its preparations for the new millennium in a highly professional and positive manner. The significant resources committed to ensuring that risks are reduced to a minimum demonstrate the sector's commitment generally to assuring continued service provision over what may prove a period of exceptional operational demand. The actions taken to date and the planning which continues to take place afford a high degree of confidence that the police service in Scotland will rise to the challenge of policing the holiday period and providing an effective and efficient police service into the new millennium.