Arts Council wastes 7 mil

Its the same era as Windows Vista. Anyone still using Vista, why not? It's it not pretty enough for ye?

"...The initial plan was to replace the largely manual grants application process with a new system.

But it grew in ambition to a "business transformation programme" which would integrate five existing business systems into one core system..."

Simon Harris lying? Nevvvvvver 🙄

Have you ever been responsible for supporting public Internet systems that are based on obsolete unsupported technologies?

When I worked for a consultancy on public sector contracts we always knew to really push for change requests and suggest enhancements in Q3/Q4 because managers at a certain level have budgets which they must use or lose the following financial year. It was pushing an open door and easy to convince clueless senior management who were more concerned about their final pension. I also saw a project that could not go live because the unions would not accept the new work practices even though the new solution saved a huge amount of time and money. Delayed it 2 years. I personally did not like the public contracts.

Slightly off topic but Unions, particularly those within the public sector are to blame for a lot of wasted money as highlighted by the point raised in your post.

Ah come on. The Arts Council is processing a few grants for artists and organising a few plays, it's hardly the National Cyber Security Centre or the Department of Defence. How much sensitive personal data are they responsible for.

Sure the reality is that some of our public hospitals have IT systems that are so outdated and out of licence that they are actually very challenging to hack.

Of course they did, it's much easier to spend someone else's money. Lessons will be learnt no doubt.

That was the phrase used on the radio (Radio 1, 1-2pm) - a tried and tested system existed which is used by other customers specifically for grant applications. It would have cost 1.5m to buy/implement. I think they meant an off-the-shelf system that they could just plug and play. I was listening to the radio on this all morning and it has all the hallmarks of a typical public sector contract that had no business owner and little or no governance. Scope creep was off the charts and there were no financial stage gates or benefits realisation checkpoints. There were no costs or options in the business case (Jaysus) and they never asked the Department for budget increase approvals. Car crash stuff. The external consultants were clearly running the whole show. They even brought in someone from Grant Thorton to act as CIO at 250,000 for one year. Alarm bells. They chose the most expensive tender response too (out of 8) which is interesting. It was supposed to be delivered in 2022! Catherine Martin did nothing. All of this came to light in the recently published 2023 annual report which was very very very late. They tried to hide it.

Lessons will not be learned.

Off the shelf is the exact opposite of bespoke, hence my confusion. It seems that they did end up going for off the shelf in the end.

The question remains as to whether off the shelf would have been the best option in 2018. If we're being charitable, it's possible that the off the shelf options that were available in 2018 didn't meet their requirements, but things had moved on by 2023/2024, so now off the shelf does meet their requirements.

Personally, that seems like an unlikely scenario. It seems they were badly advised by the IT consultancy report from 2018 which advised them to go for bespoke rather than off the shelf.

The last part I would say is very debatable. I think the HSE disasters source was a single PC running XP, I am guessing a lot of software like anti virus wouldn't be supported or in anyway up to date on extremely old platforms, so risky especially if open to the web etc.

Back in the day I remember a huge bank having a PC running a key piece of software on something that looked like it was from a 70s Sci Fi film. So I am not saying it is in any way just a PS/CS issue.

I think "quite limited" is doing a lot of work in that quote personally, would be interesting to see if the NCSC agree.

Older OSs don't always support up to date anti virus software. XP for example is out of support since 2014 and it's last security update was 2019, especially if open to the web. In my experience older OSs also won't always support the running of other key software the business area might need for their job and an up to date web browser, not a good idea.

Obviously there are also threats from people still plugging in USBs (if allowed) as well as the usual eejits clicking on every dodgy email.

At this stage wouldn't surprise me if Tubridy appeared as a consultant for his many years experience in book writing/publishing (about himself and JFK of course)

Can we just skip the PAC and go straight for criminal investigation?

I'm actually thinking the PAC is a way for the government to delay and protect at this stage. Bit if drama for the public, but that's it once over....

I didn't say there was one...that's what the investigation is for? My main point is PAC is useless, like the rte probe.

But some as the post just above mine refers to consultancy work given to potential people with conflict of interest, how was this consultancy work awarded, was it tendered and awarded correctly? But as I said investigation.