Joint Committee on the National Security Strategy

Corrected oral evidence: Biosecurity and national security

Monday 9 November 2020

4 pm


Watch the meeting

Members present: Margaret Beckett (The Chair); Lord Brennan; Sarah Champion; Richard Graham; Lord Harris of Haringey; Baroness Healy of Primrose Hill; Baroness Henig; Baroness Hodgson of Abinger; Lord King of Bridgwater; Baroness Neville-Jones; Baroness Lane-Fox of Soho; Angus Brendan MacNeil; Lord Powell of Bayswater.

Evidence Session No. 4              Virtual Proceeding               Questions 58 - 70



I: Rt Hon Penny Mordaunt MP, Paymaster-General, Cabinet Office; Roger Hargreaves, Director, Civil Contingencies Secretariat, Cabinet Office.


Examination of witnesses

Penny Mordaunt MP and Roger Hargreaves.

Q58            The Chair: Ms Mordaunt, thank you very much for coming to give evidence to the Committee. Welcome to our discussions. For the benefit of anyone who might be listening, and for yours, we are not conducting an inquiry into the pandemic. That kind of inquiry will no doubt be undertaken at some point. Our interest is in the national security strategy and its structures, the pandemic as a case study of what it means to be a tier 1 security risk, and how effective our preparations are for dealing with such risks when they unfortunately materialise. A pandemic has long been recognised as a tier 1 security risk. Broadly speaking, what has that meant by way of preparation in dealing with it?

Penny Mordaunt: By way of introduction, it might be helpful for the Committee to understand my role at the Cabinet Office. I support the CDL, who has overall responsibility for civil contingencies. With regard to Covid, my specific responsibilities have been cybersecurity and death management. I have also informally taken on a role to ensure that Members of Parliament are given timely information. It may interest the Committee to know that, as a junior Minister at the DWP, I took part in the Cygnus live exercise, so I have experience of that. I am sure Roger will introduce himself later and give you his responsibilities.

A large part of what I and Roger do is not Covid-related. It is exactly what you are asking about: civil contingencies planning. While we understandably have a framework that tries to focus effort on the scenarios that would have the greatest impact and likelihood, of which a flu pandemic was one, other aspects of the nature of this particular pandemic were not given so much focus.

When I came into this post, I looked through all the minutes, going back to 2010, of the threats, hazards, resilience and contingencies Cabinet sub-committee. Work had been done in 2015, for example, on the biosecurity strategy, leading up to Cygnus and other exercises, including smaller exercises conducted in COBRA on Ebola, flu pandemics and so forth. There was a great deal of preparation for the likely scenarios that we would encounter. We had prepared for and thought through aspects of workforce surging and some legislative things that needed to happen. Other concurrent work assisted with the challenges we were facing in supply chains.

Areas that, going into this pandemic, we had not exercised for included extreme pressures on global supply chains and PPE, which you will be very familiar with. It is easier to plan for the public sector, but we were reliant on a lot of private sector organisations, which meant setting up interfaces to allow them to access some of our public sector systems. Those were the sorts of things that we did not anticipate and were not apparent until we were doing them in real time.

The Chair: What are the things that could help us prepare for biological risks? I accept that the thinking had broadly been that this would be a flu pandemic, if and when it came, but there are some things that can help you, no matter what the biological risk is: stockpiling clinical countermeasures, developing surveillance and testing capabilities, undertaking exercises. You identified one or two areas, but to what extent have the Government undertaken those preparations, which could help with any of these risks?

Penny Mordaunt: The Government had looked at several of those aspects, but they were not central to the exercises that had been done. Given the nature of the likely scenarios that they were looking at, the unique aspects of coronavirus, being its highly infectious nature and the incredibly broad demand on personal protective equipment for pretty much every sector to continue to operate, were not well planned for. The lesson is that, as well as ensuring economy of effort by focusing on what is most likely, we need to focus on scenarios that have high impact but are less likely. That is one of my big takeaways from this exercise.

Roger Hargreaves: The situation was not one of not thinking about pandemics. We were thinking very hard about pandemics, but the broad scientific consensus was that a pandemic flu outbreak was far and away the most likely thing that we would need to deal with. That is why planning focused on that. We looked at other respiratory illnesses, such as SARS and MERS, but it was always regarded that they would burn themselves out more quickly and be limited in their spread. It was an evidence-based decision to focus on pandemic flu planning, but Covid-19 has turned out to be very different in character. As the Paymaster-General has described, we have made use of an awful lot of the pandemic flu planning work in our response.

The Chair: To summarise, it is not that being tier 1 meant that something should have been prepared for and was not, but there were things resulting from the impact of this particular pandemic that we had not identified that we needed to prepare for.

Penny Mordaunt: Yes. Our approach, which I still think is the right one, is to devote the greatest amount of effort to things that are likely to have a high impact and to come to pass. In part, this is about the interface between the Cabinet Office and the lead department for a scenario, in this case Health, with the Cabinet Office perhaps having more of an aggressive role. Even though we might not devote the same resource to it, we need to think through the additional problems and challenges we may face from events that are likely to have a high impact, even if they are less likely to occur.

Q59            Angus Brendan MacNeil: Paymaster-General, in 2019, the Global Health Security Index found that the UK was more prepared for a pandemic than most other countries. Internationally, has our Covid response matched up to that assessment? Have we learned that the definition of a pandemic may be too narrow and that pandemics can be very different in nature?

Penny Mordaunt: We should be proud that the UK has done a lot of work to move global health security forward. As you note, we have been well prepared, better prepared than other countries, but we have also identified that these things do not recognise borders. We have done a lot to build capacity in other healthcare systems, knowing that they would have a direct impact on us. About £1 billion a year is spent under the control of the Department of Health to strengthen global health security. We have done a lot on other areas, such as AMR. It is a highly complex question.

Angus Brendan MacNeil: In fairness, it is.

Penny Mordaunt: We have not done as well as other nations in some of the outcomes. We need to learn from that, but we are also in a very different situation from other nations, in part because of our strengths as a nation, our connectivity and the issues that we might face. A comparison between us and New Zealand, for example, will not be direct. You raise an important point: that we have to learn from this experience. I have been keen to stress that we should not wait for this situation to be over before we learn those lessons. We have to have continual learning and improvement, but it is a very complex question.

Angus Brendan MacNeil: I am genuinely curious. Was the pandemic that was planned for and envisaged by the Global Health Security Index the one that played out? In other words, when we say we are pandemic ready, what is the nature of the pandemic we are ready for? Perhaps there will be time later to reflect on how a different type of pandemic might have played out. That then prepares perhaps for another pandemic that might be different in nature from the one we are going through.

Penny Mordaunt: I reiterate the point I made before. It is our duty to prepare for high-impact most-likely scenarios, but we also have to ensure that we have a process. Obviously, coronaviruses have been in existence, not necessarily as the threat they are now, for some time. There are other viruses that should also be of concern to us. We need to think about high-impact things that are less likely to come to pass.

Roger Hargreaves: People judging our pandemic preparedness were looking at our preparedness for pandemic influenza. As I mentioned earlier, the scientific consensus was that that was where a pandemic would come from. The building blocks that caused the UK to be rated highly were our surveillance and modelling systems; the awareness across the scientific community and the emergency planning population of the criticality of preparing for pandemic flu; the preparedness of our research capabilities; our business continuity capabilities; our ability to carry out advance purchase agreements of potential vaccines. There is a very well-understood vaccination process in the context of flu.

As things have transpired, Covid-19 has been very different because of asymptomatic transmission, the time spent in intensive care units and the absence of an immediate vaccine. It is a more straightforward process in the context of pandemic flu. The whole world is now stretching every sinew to find a vaccine for Covid-19. We are very well placed in the context of vaccination because of our pandemic flu preparedness in respect of advance purchase. There are lots of things that build a picture of why we were so highly regarded, but it is possible to draw a linear path for why some of those seemed to be ready and did not work in practice, because we were dealing with something that no one expected.

Penny Mordaunt: Although the focus has rightly been on Exercise Cygnus, there were other exercises that did not necessarily look at pandemic situations, but looked at diseases that were highly relevant to the situation we are in now. For example, the exercise on Ebola looked at contact tracing. There were other things that were not necessarily about pandemic response but would have built up our capacity, knowledge and thought process on some of the challenges we are facing in this situation.

Q60            Baroness Hodgson of Abinger: Good afternoon, PaymasterGeneral. In their written evidence, the Government recognise that the Covid-19 pandemic is more challenging than they predicted, and state that the UK’s capabilities are being rapidly scaled up. Which capabilities is the UK scaling up, and how? How is it considering the timelines for its need to scale up?

Penny Mordaunt: There are so many areas. Testing and contact tracing have received a lot of airtime, but we have built capacity in other areas that are not in the public domain and are not talked about so much. One of those is social care. It is quite straightforward to have a command and control structure in healthcare, because of the nature of the healthcare system. All sorts of private sector organisations leaned in, from ambulances to clinics, but it was largely the NHS.

Social care is a much more fragmented system, with less centralisation of data and information. In this situation, you are looking not just to build the structure so you can get information out and map PPE requirements in real time but to put changes to the workforce in place, for example not to have people working in certain care homes, and to get good data so that you can understand what is happening on the ground.

Those systems did not really exist at the start of this pandemic. A lot of work has been done by Helen Whately and her team to build those systems. That piece of work has strengthened our ability to protect that sector, providing it with what it would need in a similar circumstance. There are many areas. I just mention that, because it has not had a lot of focus.

Q61            Baroness Lane-Fox of Soho: Good afternoon. As you know, tier 1 security risks are both malicious threats and natural hazards. It has been suggested that sometimes natural hazards are given less of a priority than malicious threats. I wondered if you thought that was true and, in particular, why natural hazards have fewer commitments for action in the 2015 strategic defence and security review.

Penny Mordaunt: What we are seeing in the current integrated review will be a sizeable step change from previous reviews that have taken place. Even very comprehensive reviews that were done under previous Governments, with a lot of consultation, tended to be focused on Whitehall assets, looking more at defence aspects and not so much at resilience. The understanding now is that we need to have much more focus on resilience in the broadest sense.

The integrated review is doing that. We have had a lot of focus on natural events, to a degree based on health security, because of Ebola and the flu pandemic potential but also because of other events such as flooding. We have had a great deal of focus on that aspect and the knockon effects on, for example, critical national infrastructure.

Perhaps the real challenge is for us to think about concurrent events. I have been focused on the potential for malicious activity, both as we deal with this pandemic and as we come to leave the EU proper at the end of the year following the transition period. It is about thinking of all that could happen, the perfect storm that we need to be prepared for in all those instances. It is about not just how we think things through in strategies and planning but how we exercise, making sure that we look at what could happen in the real world as opposed to singular events. There will never be singular events in the real world.

Baroness Lane-Fox of Soho: This Committee has looked quite a lot at digital capacity and cybersecurity, particularly cyber skills. You mentioned real world threats. There are also digital world threats. I wonder how you compare the £1.3 billion spent on the cybersecurity programmes with the spending on pandemic preparedness, and whether you see any priorities there.

Penny Mordaunt: When I came into this role in February, I did a deep dive, largely because I could see the potential for particularly malicious and opportunist attacks. I wanted to ensure that our public services, particularly those holding critical data, were as robust as they could be. A great deal of effort was spent on that, although I cannot go into too much detail, to ensure that we were as robust as possible going into this.

Going forward, I have been working with James Brokenshire in the Home Office and, across government, with every department that has a stake in cyber resilience to improve our cross-government working and our strategy on cyber. Different departments are leading on different aspects of it, but in the Cabinet Office we have moved this much higher on the agenda. We have now had several cross-government meetings with all Ministers focused on this. We are improving and building our capacity, and ensuring that we are using what funds we have in the most effective manner, both to develop new resilience and capabilities and to protect our legacy systems.

We are looking at how we can help the partner organisations we work with in the public sector, local government, healthcare, whatever it is, recognising that we need to do more to give the public sector confidence to work with the National Cyber Security Centre and the other support that is there. There are some very real barriers to that happening: reputational barriers, cost barriers for business. We need to think through smarter ways to incentivise people to do the right thing and to help us make the UK as resilient as possible. A huge amount of focus has gone into that. That has been our approach, going into the spending review. It is a much more joined-up approach across government.

Q62            Lord King of Bridgwater: Paymaster-General, apologies for my tardy arrival. Following the last question, there is a lead story in the papers today about rogue Russian elements trying to stimulate the antivax movement and discouraging people from taking the vaccine when it comes. I understand that that comes into your field.

Penny Mordaunt: We stood up a special unit in the Cabinet Office that is focused on those malicious messages. It is busy, very sadly, but it is about spotting where that is taking place and ensuring that it is combated and dealt with in the appropriate way.

The flip side of that is to ensure that we have good communications ourselves and are retaining public confidence. That is something that we map and our communications are vital in doing that. I would also give a plug to our partner organisations in this, which have been doing some great work. The University of Oxford is just one example of excellent communication about what it is doing on a vaccine. We all have a part to play in this.

Lord King of Bridgwater: That is very much in your field. I am not sure whether the next bit I want to talk about, supply chains and procurement issues, is quite so much in your field, but you are speaking on behalf of the Government, so I hope you will not mind my putting it.

Penny Mordaunt: I will do my best.

Lord King of Bridgwater: When this started, there was a real worry about whether we had the supplies we needed, whether we knew where they were and whether we had the slightest idea who could make them if we were running short. I imagine that those answers are more satisfactory now, but do we have confidence and knowledge that the domestic supplies are now secure and will be continuous, and not liable to takeover or disappearance?

Penny Mordaunt: The Cabinet Office procurement team was there in support of the Department of Health. Procurement expertise was given to the Department of Health to do that. I would say several things. First, some of the issues with PPE supply were supply chain-linked. Many of these have been worked through. We are in a much better position than we have been, in part because we have grown quite a lot of UK-based capacity. I would salute businesses that have switched very quickly to producing bits of kit, sanitiser and all sorts of things we needed.

There were other challenges with PPE in last mile delivery. Social care was clearly going to need supplies. It was extremely difficult mapping where those organisations were, having forward-deployed stores and all of that. Having been through that in the first wave, it has built a tremendous amount of capacity. A lot of that has been locally led. They needed to be bespoke solutions to a community. In my own patch, for example, we used the search and rescue teams locally who had Covid protocols, but not a deployed role, to do that last mile delivery and, at the same time, use their data gathering skills and equipment to build a picture of demand levels. It is a whole raft of things, as well as the bigger picture of what the Department for International Trade has done alongside other departments to ensure that we have supplies and resilience.

One thing that stood us in good stead was the work that had gone on under no-deal planning on supply chain resilience. I am not suggesting that it necessarily justifies having to do no-deal planning, but it certainly helped the situation that we had that knowledge about our vulnerabilities and our capacity, for example, if we had to get things from a European supplier. We are in a much better position. If we are faced with a particular challenge or scenario, we now understand the key partners we can go to so we can resolve that.

Roger Hargreaves: When it comes to supply chains, there are two elements: production and logistics. Our experience early in the pandemic showed that, within government, we have a very good partnership with industry on the logistics side and a very good understanding of how logistics chains work. That is why we were able to build some of the bespoke arrangements necessary. We were also able to intervene to keep elements of the logistics chain going, for example our intervention in respect of ferry capacity.

On the production side, the Department for International Trade has networked across government to make sure that we have much stronger knowledge of production, particularly international and beyond Europe, of some aspects. We are now in a more robust place. First, we have that greater understanding of production systems and how they work. Secondly, obviously there has been a market response within the UK and there is more domestic production. Couple that with going into a global overdrive on production of PPE and we are in a steadier place, but in the spring we were competing with lots of other countries for PPE resource that was, at that point, in relatively scarce supply.

Lord King of Bridgwater: I am not terribly reassured about lots of international sources of supply, because surely there must be the issue that, in the final analysis, it is a global pandemic. Everybody is rushing around bidding for the various supplies. We think we have an order and it will delivered, but we find that it has gone somewhere else, and somebody else has either stolen it or overbid us. Who is keeping a check on our domestic production of these things, ensuring that we have a basic level within this country? Is it government policy to say that we must have domestic capability to meet these challenges?

Penny Mordaunt: First, the Department of Health is the lead department on this. It is the department that makes a judgment not only about the stores and where we are getting things from, but about the demand and what is needed. I have been very keen to stress that that is not just about the things in the public sector. As an example, we were reliant on private sector ambulance organisations initially and during the peak earlier in the year. Those needed access to PPE because the NHS shut its supplier lists when the crisis hit, for understandable reasons. They were then not able to register as NHS suppliers and get PPE.

The Department of Health has learned those lessons. It is ensuring that, even if this is sitting in the private sector and not directly involved in health and social care—for example, death management services and community organisations might be involved in some aspects—their demand is captured in what we are making provisions for.

A big theme for the IR and all sorts of strategies going forward, which goes to the heart of your question, is the obvious truth that the people we can most rely on are ourselves. We have to think about what kind of capabilities we need to ensure that we can generate. The response from the private sector in changing production lines and producing materials was incredible, not just from companies but from community organisations, for example, making gowns to the required specs. That is a big theme: the nation’s resilience. Ultimately, we can rely on ourselves and we need to bear that in mind for future preparations.

Roger Hargreaves: As a point of detail, very few countries will be fully self-sufficient, particularly on the PPE side. By Christmas, the UK will be producing about 70% of its own PPE requirements, which is a very high figure and much higher than it was previously. It very significantly reduces the reliance on other countries and their manufacture. Couple that with our greater understanding of production and supply, and it gives us much greater confidence about our selfsustaining posture.

Penny Mordaunt: Quality control is also critical.

Q63            Richard Graham: Paymaster-General, that was a very reassuring answer from Roger Hargreaves about the 70% figure. Has the government approach to procurement tried to distinguish between different types of equipment that we might need? For example, ventilators are probably a critical national requirement at any time. PPE, including disposable facemasks, is a commodity that one would normally expect to buy from anywhere but that might be in short supply in a global pandemic. Things such as sanitiser gel can be produced at very short notice by gin manufacturers or anybody with an alcohol licence. Do you try to separate into categories, enabling you to decide what manufacturing capacity we need to recreate or stimulate?

Penny Mordaunt: Yes. There was a great deal of work at the start of this, and preceding it, thinking through not just what might be required in various scenarios, but the spec that they had to meet. Although there was a ventilator challenge at the start of this pandemic, the Department of Health had done previous work looking at the spec that might be required in a similar scenario. There was a very methodical structure which the procurement teams worked to, whether they were from the Cabinet Office or the Department of Health, including a very large operation to triage support to ensure that it would meet particular requirements.

Roger Hargreaves: The work that the Department for International Trade has done has looked at precisely this point, among other things. There are other factors to weigh up, for example not just the reliance on trade from abroad but where we are trading with and the number of choices. If you are relying solely on an unstable nation to supply a particularly critical thing, it is very different to relying on international partners with 10 or 15 choices, all of which have quite a fulsome supply. They have carried out a forensic analysis of the wide range of critical medical and other products, overlaying geopolitical considerations, supply chain considerations and a whole range of other things, to give them the complete picture that allows them to make policy choices.

Richard Graham: What was the percentage of our dependency on PPE in particular from China?

Penny Mordaunt: We can get that figure for you. I do not know it off the top of my head.

The Chair: That would be very helpful.

Q64            Baroness Neville-Jones: Paymaster-General, I would like to ask you about the governance arrangements for biosecurity. You mention the Cabinet Office from time to time in your answers. Who is ultimately responsible for monitoring the UK’s overall preparedness for the full range of risks in our biosecurity strategy?

Penny Mordaunt: The coordination of that is the Cabinet Office, but for each risk it is the lead department. For this kind of scenario, pandemics, AMR or similar health-related issues, it is the Department of Health. I think the Cabinet Office should have a more robust role in ensuring that the right things are being done. That is not a criticism of the Department of Health, but one of the lessons of this going forward is not to allow departments to mark their own homework, so that we ensure the robustness of plans and exercises, and the lead departments are tested in those exercises as opposed to being able to run them themselves. We look after particular tools such as the risk register and the assessment. At the moment, we kick the tyres, but we should develop a more aggressive and interventionistI am trying to be tactfulapproach to certain departments.

Baroness Neville-Jones: That is a very frank answer.

Roger Hargreaves: Biosecurity is a topic that runs across a number of different departments’ interests. In our experience, if you take something out of the normal order of department business, it can do more harm than good. The Home Office has a significant interest in biosecurity because of its responsibility for broad security matters, dealing with malicious threats and the integrity of our border. The Department of Health deals with human health issues, and Defra likewise on the animal health and biosecurity side. It is natural that there is a range of departments. As the Paymaster-General describes, the Cabinet Office can add value by connecting those departments to each other and pushing them to go further. We have sought to fulfil that role of offering both assistance and challenge with all departments.

Baroness Neville-Jones: When I was in government, I recall wanting to see the Cabinet Office, and indeed the National Security Council, do more driving and not just co-ordinating. Do I sense that you would like to see a more interventionist role and more accountability being demanded of departments? It would be very interesting to know how you see the Cabinet Office operating.

Penny Mordaunt: This is a personal view. I have been in government pretty consistently since 2014, aside from about six months, and worked in several departments. There should be a more relentless focus on resilience and building capacity in departments, but also in ministerial decisiontakers. It is quite wrong that a Minister might find themselves chairing a COBRA in the middle of a crisis, whether it be a health crisis or any other, having never sat round that table before. That is possible. It has happened in some cases.

Roger, his colleagues and the others we work with are professionals. This is what they do. We have deep subject matter experts in health and other departments, but what you need from Ministers is judgments, decisions and good situational awareness. That can be improved only by familiarisation with the policies, the approach and the drum beat, whether it is a COBRA or another governance structure that is applied to a crisis situation. This is where we are moving to.

I would like us to have proper inductions. There are inductions in departments, but we need a much more formalised focus on building Ministers’ capacity to deal with either an ongoing situation such as this or a shortterm but high-level crisis. We also need to learn the lessons of this. We should be a critical friend and proactively push departments where an issue might not be a top priority because of its likelihood but would have a significant impact. Similarly, we have a role, again more as a critical friend, in pushing departments on certain plans, strategies or pieces of work that are high priority for them to deliver on. I lean into certain departments already, but a more aggressive and proactive role for the Cabinet Office would be helpful. I hope that is where we are going to move to.

Baroness Neville-Jones: That suggests a very active ministerial role. Do you think that the National Security Council and the committee structure underneath it are adequate for processing the kind of close monitoring that your answer implies?

Penny Mordaunt: As I say, when I came into this post I looked back through the minutes of the threats, hazards, resilience and contingency sub-committee. I looked at the issues and reports.

Baroness Neville-Jones: Is that functioning at the moment?

Penny Mordaunt: No, it is not. This is partly why I looked at it. I wanted to understand what its business had been and, critically, who had ministerial involvement and been sighted on it. For reasons I have already outlined, unless you are building capacity in your ministerial team, it does not matter how on the ball and how focused officials are. Ministers are ultimately sat round COBRAs and other meeting room tables. You need to be building their capacity and ensuring that they are sighted on these issues, understand the background and have situational awareness.

I looked at those things. My school of thought is that you can have all kinds of structures in place. Just in this pandemic, we have had three phases with different operational and decision-making structures in place, from traditional COBRA, through the committee structure, to new structures as we come into this chronic phase of the pandemic. In my view, what matters more is attitude. This work has to be seen as core to every Secretary of State’s business. It needs to be something that we train and drill for more. Earlier in my time in Parliament, we had more exercises, in part because of the very imminent threats we were facing, largely around terrorism but in other areas as well.

The most important thing is that people understand that this is one of the responsibilities, if not the core responsibility, of Cabinet Ministers and other Ministers, that they are devoting enough time to it in the work we expect their departments to carry out, and that they are trained to deal with situations and in the best shape possible to make the right decisions. We have good structures in place, which I am sure Roger can talk to, for monitoring those work plans. Part of my remit is looking at things such as critical national infrastructure and ensuring that other departments are doing what they need to do from plans and strategies that have been set out.

Roger Hargreaves: I do not feel short of ministerial scrutiny. There are plenty of opportunities to challenge what we do and for us to present things to Ministers collectively. This is a slightly straining time because, rather than a disruptive challenge coming along once in a while, Governments have had a period of dealing with a range of things that are well beyond the norm. Structures have been set up to deal with that. Even in the absence of THRC, we can go through the national security architecture and raise issues there, and do so actively. We are fine where we are now but, as the Paymaster-General says, there will a moment of reflection post Covid, when we eventually get there. We need to reinvigorate those structures to make sure that there is adequate oversight, particularly in getting ahead of risks and preparing for them.

Baroness Neville-Jones: You are obviously very active in this area. Your answers seem to imply that the ministerial oversight and coordination, bringing the Secretary of States together, has to be conducted at a very senior level in government, by senior Ministers and Cabinet Secretaries.

Penny Mordaunt: In an incident such as the pandemic, that is clearly the level at which decisions are taken. Indeed, many of the decisions in this situation have been taken by a small group, for perfectly understandable and sensible reasons. As I say, we have been through several iterations of this governance structure since the start of the pandemic. Situations will arise where junior Ministers will need to take the lead. Clearly, we want capacity built for Secretaries of State, but anyone in ministerial office may face a situation because they are the person on duty that day. Even though someone else might take over the COBRA chair two days in, they are the person who is initially there to ensure that we are in a good position and dealing with things. I would start doing this before people took ministerial office; I would have it as a training programme for Members of Parliament coming in. That is a personal view, but it is necessary that we take a more formal approach to these things.

The Chair: Paymaster-General, your responses have been very interesting. We are talking now about what is happening in the pandemic. In ordinary circumstances, where is the responsibility for overall monitoring of our approach to biological risks? You say that it should be the Cabinet Office. I am inclined to agree with you, but the implication I am drawing from what you are saying is that at the moment it might not be anybody. If that is the case, we need to register and take account of it.

Penny Mordaunt: That is not quite what I am saying. As Roger has outlined, depending on the type of threat, there is a subject matter expert in a particular department. For antimicrobial resistance, it will be health. For animal disease, it will be Defra. Different parts of government have the expertise. The role for the Cabinet Office is to ensure that there is the right level of focus and resource on particular topics, to be a critical friend to departments and to hold them to account for the work they are doing within those plans.

In a crisis situation, where we have traditionally looked at those lead departments to sit in the chair of COBRA or the other governance structure, sometimes that is not the best approach. You want to ensure that those meetings are providing the right challenge to those lead departments. Indeed, there are situations where you will not have the lead department in the chair, but in other cases you will. We need to look at the best way to get the most effective decisionmaking taken, and to spot where a strategy or plan is inadequate. We have learned a lot from this situation, but my colleagues who do this on a fulltime basis have many years of learnings, and we need to deploy that expertise. It is not that the existing structures are dramatically adrift, but they can be better. We should be working to ensure that they are continually improving.

Q65            Baroness Henig: Much of my question has been answered. To clarify, the governance board of the biological security strategy reports to the Cabinet Office. Is that what I have been hearing?

Penny Mordaunt: Yes, but there will be lead departments, chiefly Home Office, Defra and the Department of Health and Social Care, that are the key decisiontakers and own the work plan for those strategies. I am saying that we can play a more robust role. Currently, we are there to gently prod and ensure that things happen. We should perhaps have a much more formal role, to ensure that people are doing what they need to, and to call in particular areas that could be improved or are not receiving the right level of resource.

Baroness Henig: Are you satisfied that accountability for mitigating biological risks has not weakened as a result of some of the changes?

Penny Mordaunt: Are you referring to the Cabinet sub-committees?

Baroness Henig: You are talking about the accountability for biological risks other than Covid going to departments. I am just concerned to make sure that the accountability for mitigating them has not weakened.

Penny Mordaunt: I do not think it has weakened. It is quite clear, although a bit complicated, which departments are responsible for what aspect of the work. That is not an issue. The attitude and focus of this work is the most important thing, so that it is seen as a priority in departments as it is in the Cabinet Office. That is the most critical factor to ensuring that we have good outcomes and the right strategies and contingencies in place.

Q66            Lord Brennan: Paymaster-General, Covid gives us the opportunity to consider biosecurity risks generally, not just during this Covid pandemic. The two components that arise are an assessment of the risk and the management of its consequences, should the risk occur. I can well understand the second of those going quickly to departments such as health, for them to manage and be prepared for.

We understood from documentation we have had that the Joint Biosecurity Centre was the key go-to entity, especially for the assessment of risks, which other departments could consult. Lord Sedwill, in evidence to us, emphasised its importance during Covid and that it will assess the alert level of Covid in the future. Maybe it is in the Cabinet Office, maybe it is the result of a complex framework, but if a citizen said to you, “Tell me how the go-to system works to deal with biosecurity risks”, what are they, what might happen, how do we deal with it and what is the answer?

Penny Mordaunt: That is correct. It depends on the nature of the risk. If it is a human disease or something like antimicrobial resistance, the Department of Health would be the lead department for that. There are a range of organisations that it would work with and consult. That is clearly understood.

In terms of products that help Ministers to have sight of these risks and their likelihood, and the impacts and consequences that might come from them, I know that you are focused on things such as the risk register, but there are other information products that, for example, National Security Council members would get. Those things could be improved. A focus of the integrated review is to look at improving those things so that Ministers are more aware, and not just the Ministers who are directly concerned with or working in those lead departments.

It is rare that you have just one issue that is causing you a problem at one time. You may have a whole range of them. Some might be biosecurity and some might be related to finance or a completely unrelated area. We need to ensure that Ministers, particularly those who are on the National Security Council or who have input into strategies concerning the nation’s resilience, are sighted on all these things, so they have that awareness and can make judgments about where resource should go and whether something has the right focus. That is something we are looking to improve.

Roger Hargreaves: There are a couple of important first principle points that are worth mentioning in passing. First, the response to emergencies tends to be based on the function that organisations already hold, which is delivered at a greater scale or at a greater tempo, so breaking that link makes organisations less able to deal with emergency response. As we do not have a department for biosecurity, necessarily you have a number of organisations playing a part.

Secondly, the lead government department doctrine is really important in handling emergencies within UK government, because it establishes clear accountability to Parliament and the public when it comes to the actions of public bodies and, therefore, encourages those bodies to take their planning responsibilities really seriously.

When it comes to the Joint Biosecurity Centre and other architecture, it is quite a well-worn process for establishing cross-cutting units to deal with these kinds of issues and, necessarily, we have to; otherwise, we would be forever reorganising government around different risks. We can look at the Joint Biosecurity Centre, which is relatively new and largely focused on Covid but may have a longer-term role in helping us operationally respond to biosecurity risks.

We see other models such as JTAC, the flooding advisory centre or the Joint Maritime Security Centre, and bodies that exist in more general policy such as the Joint Air Quality Unit, which bring departments together. You have clear accountability to the public and Parliament through the lead government department principle, but we have shown ourselves well able to create joint units to bring together a more joined-up operational response.

When it comes to biosecurity, we also benefit greatly from having a shared biosecurity strategy through government departments in the lead. When we sit here in the Cabinet Office, on this issue and many others, we have an important role in pushing departments to be as good as they can be, when it comes to being prepared and ready to manage the consequences.

The final important thing we do is holding the national security risk assessment and publishing the national risk register. That helps to tell a story to a community of emergency planners around the country, and to the public at large, about the kinds of risks we are dealing with, their relative weight and how, therefore, they should be managing their work to be prepared at every level of government, not just the centre.

Q67            The Chair: I do not want to be unfair to either of you, but you say, quite correctly, Mr Hargreaves, that it is a well-worn process to have agencies of this kind. There is another well-worn process when it comes to cross-departmental issues, which is to have something such as a Cabinet sub-committee. I do not want to put you on the spot and ask why the threats, hazards, resilience and contingencies sub-committee was abolished, because that may not have been your decision, but have you ever heard of an explanation as to why it was not re-established?

Penny Mordaunt: I have not, but having taken a great deal of interest in what that forum did and who was on it, I think there are other ways of organising the focus. There needs to be a regular, methodical focus on this. It is not something that the NSC itself can do; it has other things it needs to focus on. There needs to be something that has involvement from Ministers and puts a steady, relentless focus on the workstreams we require to make the nation more resilient, and on horizon-scanning and making sure that things are fit for purpose. I would like to see, as I have mentioned, some new strands where the Cabinet Office can build that resilience into ministerial capacity.

The Chair: You are right to suggest that. When you look at the biological security strategy and the stuff around it, you get the impression that there is a big hole where there ought not to be.

Penny Mordaunt: Even though it is not directly in my remit, I am aware of the ongoing work on the integrated review. The integrated review is looking at the high-end threats, but it is looking at national resilience. That is one of the big themes from it, so there is very deep thinking going on about how we do this really well.

Q68            Sarah Champion: Paymaster-General, we have heard evidence that suggests that SAGE members and, indeed, the local resilience communities are under a great deal of strain, understandably, because of the sustained nature of this pandemic. I would be interested to hear how you think government is adapting its usual short-term emergency response—both mechanisms and structures—to deal with this long-term nature.

Penny Mordaunt: This is different at different levels. In terms of our officials, the Cabinet Office and other departments have a duty of care to individuals. As part of our workforce planning, we are ensuring that we have enough flexibility so that individuals are not working at a particular tempo for long periods, especially as we are facing other things as well as the Covid situation, including preparing for the end of the transition period and wider aspects of winter preparedness, whether on other health issues or on extreme weather. Within the Civil Service, we have processes in place. I am also looking at Ministers’ resilience. There is a particularly unique situation with Ministers. Within ministerial teams, there is good practice as to how that can be managed.

We have very good feedback loops in place with local authorities and local resilience forums. We have embedded liaison officers and, particularly at moments of peak activity, we very quickly stood up liaison officers in all the LRFs, so that we had a very good picture of what the additional strains were and where we felt there were areas that might be under particular strain. One area, for example, was still recovering from flooding and its resilience forums would have already been stretched. We put in additional capacity and we are watching that very carefully.

We have a good awareness of the human factors in dealing with this. A lot of work that had gone on through Exercise Cygnus, and other exercises and planning which the Department of Health had done, looked at its workforce and resilience under great strain, understanding how it could surge, as it did, and where it could get additional support. Although we have a lot of crises and naturally occurring events, as well as malicious events or terrorist events, it is rare that we have something that is so sustained and, as my colleague described it, a chronic crisis. It is an ongoing crisis and we have to learn from that.

We have been able to look after people well. As this goes on, we need to look at what we can do, by rotating people properly and all the other things you would expect, to ensure that people are still at the top of their game.

Roger Hargreaves: The whole system is evidently under massive strain; the whole of the economy and society is under massive strain. When it comes to looking after our own people, we are conscious that we need to make this a sustainable effort. That means rotating staff and accessing human resource. Specifically, SAGE has looked at the extent to which it can broaden the pool of advisers it works with in order to bring some of that resilience.

Local authorities and local resilience forum partners are under an awful lot of pressure. That is a well-documented matter of public record. The Government have given them a lot of support and we are trying to give them technical support so that they can fulfil their obligations to their communities and their wider legal obligations effectively. Many of them have been preparing for this for a long time, but the cold, hard reality of it is such that it stretches everybody, and we are making a lot of effort to work together. One of the most helpful developments in recent years is how MHCLG, as a department, has stepped up to be a voice for local partners in the emergency planning and crisis management space within government. They provide a very effective conduit in telling their story.

Sarah Champion: My local authority has been quite remarkable, as have all the voluntary organisations that collaborate with it.

Q69            Lord Harris of Haringey: Paymaster-General, you have been very helpful, very frank and very open. I noticed that, a few moments ago, you said that national resilience will be a major theme of the integrated review. I just wondered whether you could share with us when we might expect that integrated review.

Penny Mordaunt: It is not in my remit. I am not directly involved, but I take a great deal of interest and I think it is a quality piece of work. I cannot shed any light, I am afraid, on when it will be appearing, but it is important that we look at resilience in the broadest sense. It is very focused on that and I am very pleased to see that it is taking input from a lot of colleagues in Whitehall as well as outside Whitehall, which is important.

Lord Harris of Haringey: Perhaps I can move on to the specific question. In some of the material we have seen, the Government, back in October, recognised the importance of exercises to stress test preparedness policies and stated in particular that large-scale exercises occur at regular intervals. The last exercise that we know about was Exercise Cygnus, which was held in 2016, and the one before that was in 2007. You also mentioned to us the Ebola exercise. I am not quite sure when that was. Could you clarify for us whether these exercises are regular enough?

Penny Mordaunt: I am sure we can get you a full list of what has taken place and where. Cygnus was a very large exercise over a sustained period. That level of exercising is not frequent, because they are just enormous efforts. Smaller exercises go on fairly regularly. In the last few years, we have had fewer of these types of exercises and less opportunity for Ministers to rehearse what they might be required to be involved in. There are frequent exercises on a smaller scale. We can get you a full list of what exercises have taken place and their dates.

Lord Harris of Haringey: That would be really helpful, thank you. In papers we have seen from government, we were told that it is a legal requirement for the Government to regularly test animal disease preparedness plans. Is it also a parallel legal requirement to regularly test disease preparedness plans for the public?

Penny Mordaunt: The Department of Health will lead on that. I can certainly get you the legal and statutory obligations that different parts of the health system are under, but we also have other obligations as well as legal ones. We have partnerships with international bodies. We have research partnerships. We have particular international co-operation that we are involved in. There will be many reasons why we might have to fulfil particular aspects.

At the heart of this, we come back to our national security threat assessment and the risk register that comes from that. There may well be things on there that are not a legal obligation but are a flaming good idea. That is what we need to ensure is captured in that. The Department of Health will have particular statutory duties. It is not my area of expertise in this role, but we can certainly get you that.

Lord Harris of Haringey: That would be very useful. You said earlier that you did not think it was right for departments to mark their own homework on these sorts of matters. Presumably, it is a Cabinet Office responsibility to mark the homework. Does that come into the public domain?

Penny Mordaunt: Because we have particular expertise here, we kick the tyres on things. For example, I am co-chairing a group looking at water supply and resilience in that, ensuring that Defra is doing all it needs to do in that particular area. Where we could have a more aggressive role is in making the case for resources to be put into one thing or another and providing greater challenge to departments, so we are comfortable that they are in the right place. It is a subtle difference, but it is a really important difference.

Lord Harris of Haringey: From what you are saying, you would like to be able to provide more challenge.

Penny Mordaunt: Yes.

Roger Hargreaves: On the exercising programme, we are not constrained by the availability of resources or even wanting to do these. There is a sliding scale. Tier 1 national exercises—Exercise Cygnus was on that scale—happen pretty infrequently because of the vast number of people involved, the level of organisation required and so forth. They will not be on pandemic flu every year; there are a lot of other risks. For example, Exercise Cygnus was postponed for two years in order to accelerate work on Ebola, but we had three large-scale exercises on pandemic flu in 2006 and 2007 in close succession, because that was the point at which the planning accelerated.

We are making positive choices about when the exercises should take place and we have a lot of resource devoted to them. Those exercises fulfil a training function and an assurance function, so they are useful in testing systems, but we have other means to do that as well. We push and prod departments all the time on their full range of risks to ensure that they have active plans in place. Ultimately, the responsibility sits with them, but we can offer quite a lot of support as well as push pretty hard. There are plenty of examples at any given time of where we are pushing departments to make sure that they have things in good shape for emerging risks.

Lord Harris of Haringey: The report from Exercise Cygnus has taken four years to be published, so how can people have picked up the issues from that?

Penny Mordaunt: That is not quite correct. When I came into this role and it was clear that we were going to be facing this situation, in the very early stages, literally the first couple of COBRA meetings, I sat in the Cabinet Office chair. One of my questions was whether Ministers were sighted on the learnings from that exercise. I discovered that, quite soon after the report had been produced, it was circulated to departments.

Clearly, Ministers move on from roles, so that may well have happened. I had moved on from my seat at DWP to another department, so Ministers who took part in that exercise may not have been sighted on the report at the time. The report was circulated to departments, to my understanding. I requested, in the early part of this, that all Ministers were given copies of the report and its findings.

Lord Harris of Haringey: That is Ministers. What about the implications of the findings from Exercise Cygnus for local resilience forums? Was it shared with them and with the social care sector?

Penny Mordaunt: Yes.

Roger Hargreaves: It was shared at the time with local resilience forums, so they were able to draw their lessons from it. In that kind of situation, with 950 participants and over a dozen organisations playing in the exercise, they will all have sat down afterwards, washed up on how things went and looked at lessons from the exercise in relatively real time. For those people engaged in the process, there was full access to the material coming out of it.

You raised the broader point, though, of whether these things should be played out in a more open way. It is tricky. There is a genuine point of balance there. If things are too open, they will not play properly in the exercise, and exercises will simply become a showcase where everyone wants to put on a good effort and nothing runs badly, so you do not learn things from it. Equally, if we are too closed about it, lessons are not promulgated and no one understands what they need to take from it. Likewise, parliamentarians or others beyond government cannot challenge government and say, “Youre not doing a great job of it”, which is an important way of getting government to do a good job.

We are always trying to strike that balance, and generally we sit in a place where there is very active sharing with participants and interested organisations, but we tend not to be massively open in public, because then you lose the safety and the honesty that you get in exercises. In some exercises, particularly those with a security focus, there can also be a risk of exposing vulnerabilities. We are always trying to find a balance and I accept that it is tricky.

Lord Harris of Haringey: You talked about the fact that this was disseminated among the participating organisations and the local resilience forums, which will then have looked at the lessons for them. Was that an area where the Cabinet Office marked the homework? Do you know that they looked at those things systemically and thoroughly, and picked up the right lessons, or are you simply hoping that they did?

Penny Mordaunt: We have a role in doing that. We would work with MHCLG, which has the prime liaison link with local organisations, particularly local authorities. When this pandemic occurred, as I have mentioned, as well as putting in liaison officers there was a very methodical auditin light of the real and present risk, not a hypothetical oneof the ability of LRFs, local authorities and their partner organisations to do what we would be asking them to do. That audit was done in a couple of weeks, testing everyone against the criteria that we knew they had to meet.

In addition to that and the liaison officers going in, there was an exercise at the start of the crisis. It was a table-top exercise and various scenarios were looked at. That was quite methodically done. It was not a quick job. It was done quickly, but it was very detailed. We recognised early the need to have really good feedback loops and understanding, which is why we put those liaison officers in, so that that capability was there and any early risks or strains were identified.

Roger Hargreaves: We do not chase things down to the nth degree. Ultimately, local authorities are responsible in law for their own emergency areas. We can be certain that we have given them access to lessons from Exercise Cygnus, for example. Whether they take that and then translate it into planning for an individual care home is a matter for them. Like any aspect of public service, some local authorities will be stronger and others will be weaker; some will do it very methodically and others will regard it as a lower priority.

We are not making that assessment, but we carried out surveys to understand the extent to which local authorities had absorbed these lessons. We had a group with local authorities and local resilience forums that explored, between 2018 and 2019, how they were taking the lessons on board. We are not in the business at the moment of looking for those absolute guarantees. We look to build a system that gives people access to the information, but the accountability in law and the local democratic accountability sits with them.

Lord Harris of Haringey: Thank you very much. That is very helpful. I am sure I have outstayed my right to ask questions. It would be very useful if you could share with us a note about that audit process you have just described.

Q70            Lord Powell of Bayswater: We have probably got close to exhausting Exercise Cygnus, but you are in the unique position of having played quite a prominent role in it. Do you have any personal reflections, looking back? You said earlier that Exercise Cygnus missed out on the whole issue of PPE procurement. It also missed out on a test and trace system. When one thinks of how successful countries such as Taiwan and South Korea have been with that, that was a significant omission. Do you have any personal views on how these subjects could have been taken into account or how these exercises could be changed or made yet more efficient?

Penny Mordaunt: I have mentioned that a flu pandemic, because of its impact and likelihood, was the right thing to focus on for an exercise of that magnitude, given the resource needed and the time you are taking up of local authority personnel. We should also be doing exercises that are not so resource intensive, to think through high-impact but unlikely scenarios.

There are two takeaways from Cygnus and similar exercises. I reiterate the point about building capacity in ministerial teams and officials in departments that do not regularly deal with this sort of issue. At the time of Cygnus, I was in the Department for Work and Pensions, and the team that came in to brief me on that occasion was not clearly thinking through all the things that might come up. Our briefing was me saying, “You need an answer to this” or “We might be asked this”. It is about having a much more methodical approach. If you are in or likely to be in this kind of role, you need to have been through this training to understand what in our department contributes to this, and to be familiar with other processes. That is one of the key learnings from it.

It is very rare that you are faced with a single-issue scenario. I would like our exercises to be much more complicated and to throw in issues that are perhaps entirely unrelated. What happens if we have a cyberattack and your main data systems go down on this issue? What are you going to do? There will be concurrent threats, and that is where you get into really building resilience and understanding what could happen.

There are malicious actors out there who will try to take advantage when we are facing natural disasters, so we ought to be rehearsing both of those things together. Cygnus just did not do that. Other exercises have gone on that have touched on those issues, but it is just about making sure that, as we have churn through our officials and ministerial teams, we are consistent in what capacity and expertise can be called on in any situation.

Lord Powell of Bayswater: That is very helpful and very valuable. Moving back once again to the local resilience forums, we have flogged those pretty hard already. What scale of funding is available from government to conduct those forums? I do not suggest that you give me a figure, but could you write to us with a figure, so that we can get a scale?

Penny Mordaunt: Funding to them will be done in a variety of ways, because there are a variety of partners around the table. We could provide you with figures that have been given to facilitate those forums and additional personnel or resources that have been put in to bolster them, which they can call on. Although we are largely talking about Covid here, clearly the forums have other things to do. There will be forums dealing with protection from flooding. Many forums will be focused on ports or other infrastructure that will critical at the end of the transition period, and they are also having to deal with concurrent activities.

Where they have faced those additional pressures, further additional resource has been put in. It varies from area to area, depending on the size of the task, but, as Roger has said, we have very good feedback loops to pick up on particular issues, such as the Brexit-related stuff, where Ministers are frequently in touch with all sorts of forums in those areas. We pick up the plans, whether it is policing or LA officer time, but we are not asking people to do the impossible with no resource. It is in our interests that we thoroughly understand the scale of what they have to do and that they are properly resourced to do it.

Lord Powell of Bayswater: Is there the commitment to do it at local government level? It is easy enough to imagine people saying, “Oh no, not a local resilience forum when we have so many other problems to deal with”. How do you maintain the commitment to conduct these forums?

Penny Mordaunt: We have always known this, and any reluctance not to do this is because government does not want to overload local delivery partners. So much of the Covid response and other situations that we deal with are best led locally. Sometimes there is a question over capacity and skills, but by and large we have a tremendously capable local government network. Various agencies, from the police to other parts of local government that sit around the forum table, have huge expertise. You can do certain things only with that local knowledge.

When you do things through local channels, you are building lasting capacity. A national volunteer network will have a shelf life as long as your crisis. If you allow those local partner organisations to take the lead, as we have, you put something lasting in place, and for whatever resource you are putting in to deal with a particular situation, you are also building capacity. That is the right approach and, as Sarah said, they are in the front line of this crisis. It is those people around the local resilience forums and in our local authorities.

Roger Hargreaves: Local resilience forums are a legal requirement in the Civil Contingencies Act that falls on all local responders. If any local authority chief executive or chief constable felt that they were not, or were at risk of not, fulfilling their legal obligation, they would look pretty sharpish at addressing that gap. We know that local resilience forums operate effectively in every relevant area. There will be some differences in performance but, by and large, as far as we can see, they take their obligations very seriously. Ultimately, local resilience forums are just a way of organisations coming together. They do not have a separate legal identity, so funding and support go to local authorities, police services and so on.

In the context of Covid, we have given £3.2 billion to local authorities to support their efforts, with similar support going to other local responders. It is not support to the local resilience forums themselves, because that is the means in law for those organisations to exercise their obligations to communicate, to share information and to organise themselves. Instead, the support goes to the individual statutory authorities, which then discharge their obligations collectively and individually.

Lord Powell of Bayswater: Exercises have focused on pandemics, largely. There are other biological risks. Can we be confident that those are all being covered as well in these local forums?

Penny Mordaunt: That is the importance of the risk register and the assessment that feeds it. There is the formal process of sharing that, whether it is our own exercise programme or exercises that are put together at a local level, all with other organisations involved in the nation’s resilience. I have a SimEx conducted in my constituency, which involves 60 public and voluntary sector organisations that deal with UK and international disasters. They will be guided by that exercise that we will go through of identifying those threats. Part of Roger and his team’s job is to keep tabs on who is doing what, where, through local government, health and its partner organisations or Defra, which is another key organisation in this. There will, of course, be international events and exercises that take place through WHO and partner organisations.

The Chair: One thing that comes through clearly from the very interesting things you have said about this process is the need not just for focus but for any exercises conducted to achieve the difficult feat of concentrating on preparing people for the event rather than just for the exercise.

Penny Mordaunt: Yes, that is the case. That does not necessarily mean Ministers turning up to an exercise every week; it means a training programme so that they understand processes, they know what MACA is and they know what certain protocols are. Even if they are not directly involved in an event, for example, and they are not going to be around a COBRA table, there are opportunities to watch COBRAs taking place, to gain that experience and to talk to their own departments through particular scenarios. There are clearly lots of demands on ministerial time, but we need to develop a culture where this is seen as a priority and good housekeeping. It should be part of the core day-to-day business of any Minister, junior or Cabinet.

The Chair: Thank you very much indeed, Paymaster-General. Thank you, Mr Hargreaves. We appreciate your attendance and your evidence.