1  The Agency should have been more realistic about the time, resources and management effort needed to secure the successful introduction of information technology and the associated changes to operating procedures.

■  Under pressure to deliver the benefits which the Bureau would generate and to transfer vetting from the police, the Agency was optimistic about timescales for such a complex Information Technology development and establishment of green field operation.

■  The Bureau was a greenfield operation so not directly comparable to the Passport Agency where the issues were around changes to procedures, introduction of screen-based working into a paper-based operation and replacement of legacy systems.

■  The Agency should have built a stronger intelligent customer operation and employed more external expertise to manage Capita more closely, rather than relying on them to fulfil the contracted requirements using an outcome based specification consistent with PFI guidance.

2  The Agency needed to be more aware of the risks they carried, and to have prepared better contingency plans to ensure that operating capacity was not impaired.

■  The Agency and Capita had contingency plans in place and quickly took action once problems occurred after go-live.

■  The approach to managing the contractor was, however, overshadowed by the Agency's decision to operate the contract under normal Private Finance Initiative rules and hence not to take back technical risk, placing full reliance on Capita to deliver which in turn left the Agency more exposed to the overall business and reputational risk.

3  The Agency should have had a better strategy for keeping the public informed.

■  At organisational level this appears to have worked well, and the problems at the Passport Agency in 1999 over engaged telephones and failure to answer correspondence were not replicated at the Bureau. However, customers told us that they were dissatisfied with the way in which queries were dealt with on an individual basis, which was mainly due to the performance of call centre staff in the early months who could not track applications through the whole system due to a policy decision to restrict access by call centre staff.

4  The Home Office should have exercised better oversight of the Agency, and should have been more alive to the risks and the Agency's capacity to deal with them before the Agency embarked on the project.

■  The Home Office took the view that it was an independent entity set up by legislation to implement a policy aim. Legislation was prescriptive.

5  There is a need for sound risk management arrangements, especially for projects where mistakes could lead to major costs or disruption for the public.

■  The Agency did carry out risk assessments and put in place mechanisms to manage those risks. Once problems started to occur however, there was not sufficient time to take appropriate action before delays lengthened.

■  The risks which crystallised at the Passport Agency were mainly around low levels of operational productivity and lack of adequate communication with the public, while the Information Technology systems were delivered on schedule and performed adequately from the outset. At the Bureau, the situation was different as the problems concerned delay and IT systems and processes not fit for purpose, risks from which rapid recovery was difficult.

6  Pilot testing of new computer systems should wherever possible begin on a small scale and be rolled out for testing at larger volumes only when initial tests prove satisfactory.

■  Pilot testing was carried out but did not indicate the scale of problems which would occur after go-live. There was little real experience of the operation at full volume prior to go-live despite the objective to achieve this through the pilot test.

■  With the wisdom of hindsight, the Bureau should have delayed operational launch when the pilot testing proved inconclusive. However, there was advice and various pressures to go live and this was endorsed by the Office of Government Commerce Gateway 4A Review.

■  Learning from the Passport Agency experience, the Bureau's management did investigate the possibility of a progressive rollout of the new service but was advised that the legislation did not permit them to roll out the service, sector by sector. Other solutions such as a geographic roll out were deemed not practical by the police.

■  In the event, partly due to action taken by the Bureau, levels of demand in the early months were well below forecast and the problems encountered were not due to this factor.

7  Departments should consider whether there are risks of customers reacting to delays in such a way that it exacerbates problems and develop plans for managing these risks.

■  This refers to the "run on the bank" at the Passport Agency in 1999 when the inability to get through on the telephone caused people to come to queue at the passport offices, media coverage of which caused public panic. There was no such equivalent problem at the Bureau, with good communications maintained through the Capita call centre, no queues and no surge in demand at any point caused by customer reaction to delays or media coverage.

8  There is a need for adequate contingency plans in key public services, including plans to deal with substantial losses of production capacity.

■  This has been addressed by the Agency which has prepared well for a range of risks including construction of a second facility in Darwen in case of a catastrophic failure at the Liverpool site, and having UK Passport Service staff available to boost production capacity. There is also a separate limited capacity system in place for manual production of Disclosures in the case of total system failure and this has been used to process individual cases with particular urgency.

9  In any Public Private Partnership it is essential that the public sector should understand fully the residual risks which have not been transferred and ensure that these are properly managed.

■  The reputational risk stayed with the Bureau.

10  Departments should have arrangements so that they are alerted to significant problems affecting service delivery and quality in their agencies.

■  Alive to the lessons from the Passport crisis, the Agency has ensured that the Home Office has been kept fully informed through the production of a weekly "vital signs" report which is sent to Ministers and senior officials in the Home Office and relevant other Government Departments. As soon as problems materialised, a Service Improvement Plan was developed and put in place. This began to yield results within six weeks and the situation was fully stabilised in six months.