Risk Assessment and Risk Planning Committee
Corrected oral evidence: Risk assessment and risk planning
Wednesday 26 May 2021
Members present: Lord Arbuthnot of Edrom (The Chair); Lord Browne of Ladyton; Lord Clement-Jones; Baroness McGregor-Smith; Lord Mair; Lord O’Shaughnessy; Lord Rees of Ludlow; Lord Robertson of Port Ellen; Lord Thurso; Lord Triesman; Lord Willetts.
Evidence Session No. 24 Virtual Proceeding Questions 235 - 241
I: Professor Brian Collins, Vice-Chair, National Preparedness Commission; Lord Harris of Haringey, Chair, National Preparedness Committee.
USE OF THE TRANSCRIPT
Professor Brian Collins and Lord Harris of Haringey.
Q235 The Chair: Good morning and welcome to this evidence session of the Lords Select Committee on Risk Assessment and Risk Planning. This morning we will take evidence from the National Preparedness Commission and from science fiction writers. We will have a number of questions.
We expect to finish the first panel at about 11.15 am and the second panel probably at about 12.15 pm.
I welcome Lord Harris, the chair of the National Preparedness Commission, and Professor Brian Collins, the vice-chair of the National Preparedness Commission. Welcome to you both. We have a number of questions. You do not necessarily both need to answer all the questions. A note will be taken of your evidence, and you will have the chance to correct it, if necessary.
What in your view are the greatest risks facing the UK? Are there risks to which the UK is particularly vulnerable? What is your assessment of the reasons for that vulnerability, or those vulnerabilities?
Lord Harris of Haringey: I am not quite sure what you mean by the greatest risk. Do you mean the most likely, or the most devastating? We can ignore that for a moment, because, as you know, there will be a spectrum.
A significant point is that most people have been surprised by the speed with which norms of society unravelled—deserted city centres, businesses shut down, enforced social distancing, mask wearing and so on—over the last 14 months, and certainly few would have predicted that, after the initial lockdown, we would still only tentatively be meeting inside.
Global pandemic is clearly a major risk. It has already cost the Exchequer a third of a trillion pounds. We should all be concerned that, as Mike Ryan, the head of the Health Emergencies Programme at the World Health Organization, said only a few months ago, while Covid has been severe it is not necessarily the big one.
You have global pandemic. Then there is a series of global trends that are likely to impact directly or indirectly on the UK over the coming years. First and foremost is obviously climate change. That will bring more extreme weather events, both here and abroad—floods, droughts, storms, heatwaves and heavy rainfall—which will become more intense and more frequent. Indeed, some parts of the world will become increasingly uninhabitable, driving huge refugee movements, shortages of food and water, impact on global supply chains and political instability, which will spill over national borders.
We can also expect increased competition and greater supply insecurities for natural resources. That will include rare earth minerals that are needed for technology. That is all in the context of a changing world order and rapid geopolitical change. You have that international environment creating more uncertainty, more volatility and more danger.
In addition, we are relying, and not just in this country, on ever-more complex and interconnected systems. This brings the threat of cascade collapse of interconnected systems, which have their own vulnerabilities. We have seen what happened three months ago in Texas. That highlights a failure, which is true of this country, to invest adequately in the maintenance of critical infrastructure, with no one agency responsible for the effects on the system.
You, Lord Chairman, and I have been preoccupied for a number of years with the implications of a wide-area power failure, and what would happen if it lasted longer than a few hours. Communications would go down. There would be no internet, no telephony; fresh water supplies could not be pumped; sewage could not be cleared; the financial system could not function.
That is the context. There are a lot of big risks out there. I am not sure I would pick which is the greatest. Some are more likely than others. Some might have worse consequences if we have not taken mitigation steps.
The Chair: Thank you very much. That was very comprehensive and helpful.
Professor Brian Collins: Thank you very much for inviting me to be here today. I would echo what Lord Harris has just said with regard to the externalities, the events that might impact us: extreme weather as a result of climate change, pandemics that might even be worse than the one we currently have, and supply networks on which as a global trading nation we are totally dependent. The recent event in the Suez Canal showed how dependent we are.
The biggest risk that we are facing is our inability to organise ourselves to cope with the systemic interconnected complex environment in which we now live. We are dependent upon getting ourselves into a better place. We seem to assume that someone—"they”; the Government or some organisation—is getting into a position so that, were these things to occur, we would be prepared.
My fear, and the biggest risk, is that we are not prepared, or we are not as well prepared as we should be, and as we are expected to be, to deal with situations as they arise. For me, the governance and organisation of the response to the interdependency, the complexity and the rapidity with which some of these things could descend on us—in particular, some of the cyber-related issues that Lord Harris did not mention, where we are now very dependent on real-time data—is the greatest risk.
It is not an external risk. It is an internal risk, in the sense that we do not organise ourselves properly to use what we know, and to use our capability and capacity to good effect in being better prepared than we are currently.
The Chair: Let us see whether we can get into some of those things in the session that follows.
Q236 Lord Willetts: My question follows on from what we just heard from Professor Collins. What is your assessment of the UK’s current approach to risk and risk planning? Are we a resilient country? Our committee has been hearing a lot of concerns about this. How are we doing it at the moment? Can we do it better? Perhaps, Brian, you want to follow on from the remarks you just made.
Professor Brian Collins: Thank you, David, if I may call you David. We used to work together in BIS, as it was then—a decade ago, I fear to say, although it does not feel that long ago to me.
I think that we are too dependent on mass heroics. We are very good at mass heroics, but some of these events are so dangerous for the well-being of the nation that we cannot depend on that. We need to do a lot better. There are mechanisms out there for scenario planning, plausible arguments for what might happen, and, indeed, to look at what capacity and capability would need to be put in place in advance of an event arising, so that when the data shows that this is the trend that we are facing, we can put in place that knowledge—that hindsight—to do better.
Government at national and local level is set up by being divided into departments—into silos of one sort or another. Unfortunately, most of the events that we are talking about cross those boundaries very quickly. A flood will take out transport, which may take out fuel supply, which may take out electrical energy. They are all in different departments.
For me, it is about the lack of “joined-upness”, if I can use a word that we are using in the work that I do in infrastructure. We just do not do “joined-upness” very well at all. I do not believe that we do risk assessment and planning in a joined-up way, with sufficient depth and accuracy, and with sufficient foresight that enables us to do a better job.
A lot of academic work is going on right now. Indeed, just before this session I was reading a paper that has just been published on exactly that: how do you put risk management and scenario planning together to deliver a better toolkit for risk assessment and planning?
Are we a resilient country? It depends on what you mean by “a country”. Some policy is good, and some of the community responses are good, and some individuals, clearly, are incredibly good. Are they acting in concert? It sort of happens by accident rather than by design. Exercises do happen, and Lord Robertson will know from the military in particular, and in the intelligence world that I used to work in, that that sort of stuff is de rigueur. It is what you do all the time, and you are expected to know how to behave in certain circumstances that may be plausible, may not be expected, but you know could happen. The sort of discipline that comes from the military could be used to much greater effect in understanding how to deliver civil contingency responses.
Lord Willetts: Lord Harris, do you have any observations on how we do risk assessment at the moment?
Lord Harris of Haringey: The latest national risk register was published at the end of December, just before Christmas. It contains 38 major risks and highlights exactly what Professor Collins has just said: that these are all organised in silos and there has not been much thought to their interconnectedness. For example, in the lockdown of the last year, no thought had been given to the consequences for the education system. There were plans in place for what you do if a school collectively cannot take exams, but not if the whole system is not enabling schools to take exams. It is about looking at the connections between them, or the fact that risks may be linked together.
The second problem with the national security risk assessment is that it focuses on the next two to five years—things that are immediately foreseeable—so it misses out some of the long-term issues that come forward.
The other part of that is that you have the national risk register but you do not have next to it the series of mitigations that are in place, which you would normally get in a risk register.
The good news is that in the integrated review there is recognition that we need a comprehensive national resilience strategy. What I think is particularly important is the recognition within that that this has to be a whole-of-society approach, involving businesses, individuals and organisations.
That is exactly what the National Preparedness Commission has been saying since it was established last year: that we need to make every level of government, every organisation, every community, more resilient. If you can do that, it creates—dare I use the phrase today?—a sort of herd immunity for a society better able to address future global crises, whether it is a new pandemic, a massive cyberattack, or climate change. That is also true right the way down to every household and every individual. Genuinely, as someone once said, we are all in it together.
Lord Willetts: Thank you for that suitably mischievous advice.
Lord Mair: Can I follow up on this question of preparedness and ask perhaps Professor Collins first, and then Lord Harris, about the role of modelling and simulation and stress testing? I am particularly interested in your views on the role of digital twins.
Professor Brian Collins: It is a huge subject. The idea that you can build a simulation or a model of what you are facing so that you can do what-if experiments on the data that you have, and the data that you might get in the future, is well established in lots of other areas of endeavour. Most civil aircraft are built on the basis of building a complete simulation of it in a digital twin and flying it. They literally fly that through the test flight, build it and hope that it is identical. The A380 was a really good example of exactly that.
A lot of experience in areas other than civil infrastructure, the built environment and transport systems in general could be of huge benefit for the much better exploitation of digital twins as a way of exploring possible futures and stress testing the envelope of external parameters on which they might work. That is exactly what you do with an aircraft: you make sure that the natural conditions in which you want to fly it do not make the aircraft fail.
To do that in other dimensions, in other systems and other services is perfectly reasonable to attempt to do. We now have the data. We certainly have the computing power to do all that. Indeed, there is a big programme that Lord Mair and I are involved in, which we have established over the last five or six years, which is doing exactly that type of modelling. It is driven out of Oxford but involves about 12 other universities in the country. It is exciting people to realise that that sort of modelling can deliver not only huge benefit to the planning and foresight for resilience but for normal operations, so that they can be run more effectively and efficiently for the good of society.
Of course, you need good data. Sparing Lord Mair’s blushes, a lot of what he has created in Cambridge University in sensing what is going on in the environment around us provides us with high-fidelity data to feed the models with good stuff. Good data, good modelling and what-if experiments are a major investment that we could make in this country to improve our resilience, and improve our capability to plan for futures that are going to be stressed, by not only the things we have talked about in some of the major risks but some of the things that we have not yet imagined because we do not really know what the parameters might look like, such as changes in demography and, possibly, the speed with which certain types of industry now work. If you look at the finance industry, in the lifetime of most of the people on this call it has gone from taking three days to clear a bank statement to half a millisecond. Those parametric changes stress the way in which we live, and we need to know what that is going to do to us into the future.
Lord Mair: Lord Harris, the National Preparedness Commission produced a very interesting report recently in which you talk about, among other things, cyber ranges—simulations of cyberattack, which both of you have mentioned this morning—where one group tries to exploit the vulnerabilities present in a system and another group tries to defend that system. Will you say a bit more about that because it is rather topical, given what has recently happened to the Colonial Pipeline on the eastern seaboard of the US and other examples? Will you say a bit more about cyber ranges and simulations of cyberattack?
Lord Harris of Haringey: It is important that you have much more willingness and readiness to exercise and to simulate the unexpected. That is part of the delight of using digital twin approaches. You need to have external challenge and red-teaming, which is I think what private industry would call it, whereby you get somebody else to look at what you are doing and say, “If we were trying to break it, or get into it, this is how we would do it”. That is an accepted technique as regards penetration testing in the cyber world. There are a number of other similar things. It should be a natural part of it.
There is a great danger. It is all very well saying that you will need to exercise the various events, but what tends to happen is that people exercise the plan. The plan works because everybody knows what they are supposed to do, but the reality is that you are usually confronted with something other than what you have planned for. It is the generals fighting the last war. It is the argument that what you have prepared for you deter, or you make less likely to happen, so what you actually confront is something different. You need external challenge. You need people red-teaming. You need the mechanisms, the digital twins and other simulations to ensure that you get into that and you see the consequences.
Some of the work we have done has highlighted the importance of organisations stress testing themselves—of knowing their tolerances and the acceptable levels of failure. Senior management—and this is as true in an organisation as it is in government—need to discuss and consider what future failure looks like, so as to avoid complacency. They have to understand the interdependencies of what is important.
I remember being part of an exercise in London looking at a major power failure. People came into the exercise thinking, “We are okay, we have an emergency generator in the basement”—which is not necessarily the best place to have an emergency generator if the cause of the problem is a flood. We started to talk to them and asked, “What would you do then?” “We would call in the engineers”. “How will you call them in if there are no communications?” Or you start to put the question, “How long will your office operate if there is no water and you can’t get rid of the sewage?” It is those sorts of things. You could see, as the morning wore on, people’s faith in their plan dwindling and their thinking, “We need to go back and think about some of these other connected issues”.
Lord Mair: In response to the question of whether we are a resilient country, having said all that, is your answer no, we are not?
Lord Harris of Haringey: We are on a scale, are we not? We are better than some places. If you think about it, some parts of the country are more resilient than others. Some parts of the country have been tested. Those who have the joys of living in scenic places that are flood risks will know what happens under circumstances of flood, and a resilient structure is built up. For somebody such as me—an unreconstructed city dweller—I wonder whether the interconnectedness works in a city, and whether we are quite as resilient as we think. The assumption is that, if the power goes off, someone is going to sort it out and it will come back in 20 minutes. It is the same with the water. You have to build those societal and community structures, which is why I talk about the importance of every level of society, business and organisations preparing themselves to be resilient.
Q237 Baroness McGregor-Smith: Lord Harris, when you have discussed resilience in the past you have said that some of the changes needed are generation-long endeavours. We are really interested in understanding how we build a longer-term approach into our policy-making, and what the greatest barriers to that are.
Lord Harris of Haringey: Some crises arise very suddenly and unexpectedly, and require urgent action—you need mechanisms for that—but others develop over a much longer timeframe of decades. Climate change is an example of an issue that has taken decades to develop. And the response needs to be equally long term. How do you respond to that? The question that I hope your committee is going to answer is: who takes responsibility and takes the long-term view?
Like many people on this call, I regard myself as a recovering politician. I wonder slightly whether a democratic system, where the issue is “not in my term of office”, enables us to take a long-term view, particularly of some of these very major potential risks that still might not happen. You can see some things coming down the road and you have to take responsibility for them. For the things that are less likely, that is more difficult.
There has to be a change in mindset. It has to be expected. There has to be the expectation on Governments, business and so on that they take the long-term view as well as the short-term view. That is difficult, particularly in business, where the focus, as you know, Lady McGregor-Smith, is very much on the annual figures, if not the quarterly figures or even the monthly figures, and it becomes very difficult as a consequence.
Baroness McGregor-Smith: Absolutely.
Lord Harris of Haringey: That change in mindset has to take place.
We should be looking right the way through the age range. I am a great believer that, in the same way that we teach children how to cross the road and road safety—and there is now an expectation that we will teach them about internet safety—we should be talking to them about resilience, and how they and their household should be prepared. I suppose it is going back to Baden-Powell and “be prepared” and all that stuff. If you start at that age, so that it is naturally built in—“What do I do?”, “Where is the torch?”, “Have I left it on?”, “How can we cope under those circumstances?”—it would have a knock-on benefit for the parents and the rest of the household, and for society as a whole. It needs to be looked at generationally, starting with children.
Baroness McGregor-Smith: I am really interested in this policy point. I definitely agree with you about business, where you are literally up against quarterly numbers or half-year numbers and are rarely asked about resilience—although you might be occasionally. It is quite challenging to build it in, but you still have to build it in. Is there more that policymakers could do? What about the funding, for example?
Lord Harris of Haringey: There are huge issues about funding. Part of the problem is that there is not an accepted way of valuing being prepared; of valuing your resilience. If it was seen as part of, “Here I am presenting my returns as a business, and yet the big hole in the middle of all this is that I have not invested in being resilient”, we would see that that is a business that can fail in the event of an unexpected shock, That is something that investors ought to be concerned about, but at the moment they have very little visibility of that, and there is no accepted way of valuing it.
I hope that the National Preparedness Commission will be able to do some work looking at precisely that idea and at how we might take that forward. Indeed, I have a meeting next week with someone from the Manchester Business School which I hope will help us to take some of those ideas forward. It seems to me to be an essential part that there should be an accepted way of valuing the importance of resilience, and it then being apparent if you are irresilient—if you have not made those investment, and you have not worked out what you are going to do in the event of various crises or stresses.
Lord Triesman: I would like to follow up a couple of those points. I have found this really fascinating, I have to say. Toby, if I may call you that—I will get used to calling you Lord Harris, if you prefer—I entirely recognise your point about faith in a plan. I have seen several people suffer total eclipse in their faith in their plan during the course of testing it.
In business there is one mechanism that we all use, which is, essentially, I suppose, depreciation. We look at some of the assets that we rely on and we systematically write them off over a period. I wonder in the case of national resilience, or resilience in big areas, how fast we think things are getting into a worse state, how we know, and when we expect to see possibly a very significant failure.
An example might be the pressures on a dam. They plainly will increase over a period of years, however well-constructed. There was a big problem, I recall, when a number of girder bridges failed, with disastrous consequences. How much do we know about the decline in our resilience? How prepared are we to respond to that?
Lord Harris of Haringey: I suspect that the answer is that we do not know anything like enough about it. There is a temptation in government that, when one talks about national infrastructure, what you envisage is the relevant Secretary of State being able to appear with a hard hat at a photo call, opening something new and shiny, whereas the most important investment may be ensuring that the dam or the bridge is secure, robust and does not fall down. That is very much less glamorous, very much less visible, because you cannot know.
I have sat in meetings where we faced financial pressures. The easiest thing to do is this. First, you cut the training, which is not necessarily a good idea in this context, either, and then you say that the maintenance can be deferred for a year or two. Then your successor comes in and takes the same decision, and you suddenly realise you have gone five or 10 years without doing the maintenance, and you are back to doing the essentials.
That is the risk that exists all the time. We have to try to find a way of making it impossible for organisations to take that sort of decision because it will be flagged up, highlighted or red-lighted as endangering the whole enterprise, or the whole mission of a Government, or whatever else it may be, by failing to make that investment.
Lord Triesman: It seems to me that it might be very sensible to do exactly what you said. Do you and Professor Collins envisage elements in legislation which compel that assessment to be made, so that it is not at the whim of a politician who may or may not be there, or may not be the Minister, in two months, let alone in two years or three years, and who in 20 years or 30 years certainly will not be there? Should we compel ourselves to do this?
Lord Harris of Haringey: We need to move from an approach that is “just in time”, which is very efficient, and sweep out the redundancy and the duplication and make things as efficient as possible, because that has built in the fragility, the brittleness, if something goes wrong.
Yes, I think that it would be important for businesses and for government to do that. I would like to see a process, possibly subject to parliamentary scrutiny, by which the Government not only publish their risk register but publish the mitigations that have been taken. A parliamentary committee—perhaps a reborn version of this committee, or the Joint Committee on the National Security Strategy—would regularly look at those assessments and, if you like, red-team it and say, “Is this adequate? Is this enough?”
The argument will be made that some of these things cannot be discussed openly. Either you empower the parliamentary committee to look at it in that way, or you say that the Intelligence and Security Committee looks at it. There are ways around that.
Similarly, you would expect a business or an organisation to do more than just say, “We have a risk register, and the board examines it in the last five minutes of the quarterly board meeting and signs it off”. The various mitigations must be clear and public, or at least there must be some way of demonstrating or auditing the fact that those mitigations had been examined and were adequate.
Lord Triesman: Do you follow that same line, Professor Collins?
Professor Brian Collins: Indeed, and I would even say that there is an example out there that could be used in a broader community—the Climate Change Act. That Act enshrined compliance with targets for Governments of the day—and of course we have been through a number since 2008, when it was taken through Parliament.
Alongside it there is a very important body, the Committee on Climate Change, which was set up at the same time in the same Act. The climate change committee has powers with regard to making recommendations, if not more than recommendations, to the bodies that govern and have stewardship of the environment. It is not just the Administration of the day; it is the regulators as well. The regulators could also toughen up their direction of travel on resilience, not only individually but collectively.
I helped to write a report in 2009 that helped to create the UK Regulators Network. It has taken quite a long time for the teeth of the UK Regulators Network to start grinding on real stuff, which is a shame, because it was transparently obvious 10 years ago that that was needed. That could start taking some of the risks of the lack of visibility and interdependence out of the game, but it could also enforce, as you have intimated, some level of compliant behaviour of not only government departments and agencies but the private companies that run a lot of our infrastructure, remembering that a lot of it has been privatised over the last 30 or 40 years.
The whole interdependence of the stewardship, if I can call it that, between Parliament, the Administration of the day, regulators and companies, could be re-examined with regard to how we enforce behaviour over the next century and move us in a direction that makes everything more resilient and at a lower risk.
Yes, we can do it, but we must do it all. If you leave a gap in any of those elements, that will be the place where things will still be going wrong. Of course, one of the tricks that we need to pull off is where the stewardship of the overarching governance framework of all this is. If that is not in Parliament, where should it be?
The Chair: I remind everybody that we would like to finish this panel by 11.15 am, so please can we pick up a bit of speed?
Lord Browne of Ladyton: I am tempted to ask both our witnesses what steps they are taking to ensure that the National Preparedness Commission is a generation-long endeavour, but I will be less mischievous.
I want to ask about baseline preparedness. On the “About” page of your website, where you explain the work of the commission, you talk about recognising that what is needed better to prepare for many shocks is the same whatever the initiating crisis or incident.
Secondly, in a discussion paper, you talk about recommending an analysis of what a baseline level of preparedness would look like. My question is: what progress are you making on that? What does that look like? What does a baseline level of preparedness look like, or preparedness that prepares us for the parts that are there no matter what the initiating crisis or incident is?
Lord Harris of Haringey: May I explain the thought behind it being the same response whatever the initiating crisis? If you think back to the beginning of the pandemic, there was a very early issue about what we do to support vulnerable people living on their own. That is the same if it is a pandemic, or a flood, or a power failure. The focus is on dealing with that sort of issue because it will come up in all sorts of examples of a crisis. It makes it slightly easier, because some of the issues we are confronted with are so so enormous, that the danger is that everybody just admires the problem, and says, “Here are some low-hanging fruit. Let’s get these things sorted and out of the way because we will need them, not necessarily for that crisis but we will need them for some crisis”.
Lord Browne asks me how far we have got in our thinking. Let me be quite clear. The National Preparedness Commission had its first meeting almost exactly six months ago. We do not have an office. We do not have permanent staff. I will not say that we are living from hand to mouth, but, yes, we want to be a generation-long endeavour, or at least I would like to see it as that. But we will not solve all the problems, certainly not in our current incarnation. If you have suggestions about how we get into a better position, that would be good.
As a nation, we desperately need to do a baseline assessment. For example, government could commission the research councils to do it, if they do not do so already. I wonder whether government really knows. I have been trying to establish this.
The national risk register talks about £5 billion or £6 billion being spent on flood relief. What you cannot see, and perhaps there is detailed working somewhere else, is whether that £5 billion or £6 billion is the right sum of money. How much flooding is it going to mitigate, and in which areas? How has that analysis been done? Or is it, “This is the sum of money we have got left over that can be used for flood relief”?
Unless you have that baseline assessment, right across the whole panoply of infrastructure, across the fabric of society, and against all these risks, you simply do not know. I would like to believe that, somewhere in government, there is somebody who does know. But I rather suspect, certainly from all the discussions I have had, that this is very patchy, and it needs to be systematic.
Professor Brian Collins: The academic community is anticipating that these questions need to get answered. There is considerable investment going through the research councils into a family of programmes to help understand infrastructure, in particular, and the services on which we like to depend as a “developed” society—energy, transport, waste, water and digital. Those five things are absolutely critical to the survival of how we live and want to live in the future. We have managed to convince the Government to spend of the order of a couple of hundred million pounds over the last five years in creating capability to do research in that space, and to couple that to industry, so that industrial solutions that are being delivered for future infrastructural services have properties in them that are to do with resilience, to do with risk mitigation, and to do with adaptability, so they are more flexible for dealing with uncertain futures.
That programme is just beginning to take off big time. The investment phase is just about through and we are starting to invest heavily in, first, young people—we have a major doctoral programme. Going back to Lord Harris’s point about the generational issue, without hundreds of professional people coming through in the future, we will lack the capability and capacity to build future-proofed infrastructure. That is a major investment coming in.
Coupled with the big projects that are going on, we are looking at how we improve their situation with regard to flexibility and risk management. The academic community did not wait for an instruction. It just saw this coming and got on with it, and that is in process.
We are also developing relationships, as is the preparedness commission, with the national institutions—engineering, science, medicine—so that the professional activity that they carry out is coupled together. It is this “joined-upness” that I mentioned earlier. As actors in this space, and as respected voices, they need to pull together to deliver policy guidance and investment guidance for doing things better.
Thirdly, which I think is rather important at the moment, we are developing national facilities that allow us to understand how people interact with what it is we are building. There has never been a real laboratory to do practical work on how people get on and off trains and buses. We just assume that they will behave in the way that they have always behaved. Going forward, with changing demography and changing situations, we need to understand better how that will work.
We also need to understand those people in our society who want to disrupt that, whether you call them terrorists or whatever. We have another laboratory that is being built. They are both at UCL, but they are part of a community of laboratories around the country that will enable us to do real experiments, with real people, to understand how those situations matter—why a certain built environment incites fears in people, and how it feels different for men and for women. We know now that men and women feel differently with regard to the environments that we build, so that risk of a response is modulated by the way in which we build stuff. We have not known that in that level of detail, and we need to know it for the future.
The academic community is getting its act together. We are starting conversations with policymakers and with investors. That is the longer-term investment that we need to make, and that will also help us baseline where it is we are starting from.
Q238 Lord Robertson of Port Ellen: This committee has been absolutely fascinated by the witnesses that we have heard from and by the reading that we have done. The question here, which has already been partially addressed, is how on earth we embed some of these lessons into government, and indeed into society as a whole. This committee ends its life, by the custom of the House of Lords, by the end of this year and then disappears completely. So the question is: how do we take forward the issue that we have identified as being acutely important? The integrated review of foreign policy and everything else puts resilience, for the very first time, at the heart of British policy. How can that be embedded?
One possibility is your National Preparedness Commission with a longer stretch of life. I looked at your website as well, and I cannot find out who funds you, what your set-up is, or who you are accountable to. It seemed to me from the commissioners appointed to be pretty top-heavy, but, as you say, you have no office and hardly any staff. Are you the answer to the question?
Lord Harris of Haringey: I certainly would not claim to be the answer to the question. There is a list of sponsors, and we are very grateful to them for enabling us to fund the work that we have already published and the work that is in train. As I say, it is almost hand to mouth, and some of that funding runs out unless it is renewed.
There is a role for something like the National Preparedness Commission, or something that we might morph into. This purpose of external challenge—of someone who is independent of government asking some of these questions and raising some of these issues—I think is an important one.
There is also a very important parliamentary role. I have already mentioned either a future committee set up with a remit like your own, or the Joint Committee on the National Security Strategy, and some of it perhaps being looked at by the Intelligence and Security Committee.
To avoid groupthink, you have to have diversity of thought and external challenge. There need to be mechanisms that involve external advisory groups, provided they are independent of government. You do not want something that is supposed to be, from time to time, waving the red flag but feels it cannot. That is why something that is just within government, although in principle it might work, may not always be quite as confrontational on the difficulties that need to be pointed out. By confrontational, I do not mean loud noises and headlines. I mean saying, “We still don’t have this right. We still have more to do”.
The difficulty is that being prepared and resilient is expensive. If you park the just-in-time approach in favour of “just in case”, and say that we are building in redundancy, we are building in spare capacity, and we are trying to avoid that interdependence, that is hard. It is difficult for politicians to devote resources to projects that do not come to fruition by the time of the next election, or to build resilience that is probably invisible and might never be needed, for an eventuality that may never happen. You have to create some countervailing institutional pressure to ensure that resilience is carried forward. A statutory report on mitigation and actions taken would be useful. Avoiding groupthink and having external challenge are all part of it.
Lord Robertson of Port Ellen: How would you do it with a national security risk register that nobody seems to be able to see outside very restricted areas of government?
Lord Harris of Haringey: There is a published version, but, as I say, that simply looks at one half of the equation. It does not really look at mitigation. There are odd phrases, such as the £5 billion for flood relief, which say that something is being done, but it is about looking at both sides, as you would do, or should do, on the board of a company—look at the risk register and the mitigations. The task of the directors is then to scrutinise that and say, “Is this adequate? Is this enough?” I suspect that in many instances that is not done systematically.
You have to create a mechanism that allows it to happen. That means greater sharing. In fact, there is a very strong argument that says that there should be a willingness to share knowledge about the risks that government may have with other parts of the economy, and with the businesses that may have to confront that. I think we are very weak there. There has been a bit of a move towards that with the National Cyber Security Centre, but I am not sure that is mirrored in other sectors.
Lord Robertson of Port Ellen: I am sorry to go on, but the national security risk register is different from the national risk register. It seems that access to the national security risk register—for reasons that in many ways are quite obvious—is very restricted indeed. Even this committee has found it difficult. If we get to see it, we will see only stuff that is at sub-confidential level, never mind sub-secret level. Does that not mean that your commission, or something like it, will have one hand tied behind its back when it tries to do the challenging or the interrogation?.
Lord Harris of Haringey: Inevitably, if you are not part of government, you are not going to have that stuff shared with you. I hope that, if we ask the question enough times, there will come a point when you perhaps get the assurance, or a parliamentary committee with the right authorisation gets the assurance, that that issue has been dealt with.
Personally, in a completely different field from this, some years ago, I was briefed about what sounded like a pretty serious cyber weakness in our system. I started talking about it. Eventually, I think more by exhaustion than anything else, I was tapped quietly on the shoulder in Portcullis House by somebody who knew, who said, “Look, stop worrying about this because we are doing this and doing that about it”. Probably that was a breach of the Official Secrets Act and whatever else. What I am saying is there has to be a mechanism that allows that to happen.
I recall that, a few years ago, the Joint Committee on the National Security Strategy was summoned to COBRA to have a presentation on the more secret bits of the national risk register. We could not take notes. It was put up on a big screen, but the print was too small, at least for me, to read all the things in the various different categories. Yes, it gave us an idea of the scale of what was being looked at, and the fact that there were issues being focused on, but it was not proper scrutiny. I think that you need to build in mechanisms for proper scrutiny.
The Chair: I am still concerned about the time. Thank you, Lord Harris.
Q239 Lord O’Shaughnessy: This is a question for Lord Harris. Good morning, Toby, it is good to see you. This is not the first time that you have been asked to review or been involved in a commission reviewing a major disaster. You were asked in 2016, I believe, to conduct a review of London’s preparedness for a terrorist incident, and that review made 127 recommendations. I am keen to know how many of those have been implemented. For those that have not been, why not? What are the lessons that we can learn from that experience that should apply to the recommendations of our committee, and indeed to your commission?
Lord Harris of Haringey: One year after my report was published, the mayor’s office reviewed progress on the recommendations and reported that two-thirds had been implemented, and that in those agencies under the control of the mayor—primarily the fire service, the police service and Transport for London—all the recommendations had been accepted in principle.
I am pleased to see that the mayor’s recent election manifesto committed him to commissioning an update of the review, because the reality is that you have to have those updates; you have to look at implementation. There is a huge gulf between identifying a lesson, accepting a lesson and taking appropriate action from a lesson. You also find, as I did with some of the recommendations I made, that a degree of mission creep or drift happens after an initial recommendation is accepted and, in theory, adopted.
In any event, circumstances change, and of course learning and experience need to be incorporated into it. There have been subsequent events since my review, such as the Salisbury Novichok poisonings or what is emerging from the Manchester Arena inquiry. You need to come back to it.
I could give you examples of drift. There are two specific examples of where there has not been progress: public alert technology and ensuring schools do more about security. There is an inertia: “It is not quite our responsibility”; “Whose responsibility is it to make this happen?”; “Who is going to pay?” There is then the optimism bias: “It couldn’t happen here”, or, “We cannot see this happening”. You have to keep coming back to that if you are going to make progress.
Lord Clement-Jones: Toby, it is very nice to see you. I want to follow up on that, because your report has quite a lot of common factors for other local resilience forums. You have mentioned the integrated review and the aspirations in that. Do you think that there should be new legislation to enshrine some of your recommendations that have not been able to be put into effect with, say, a new civil contingencies Act or something of that sort?
Lord Harris of Haringey: There is a case for reviewing the Civil Contingencies Act; indeed, there has to be by statute within the next year or so. The National Preparedness Commission has set in train our own look at the Civil Contingencies Act and the way that local resilience forums should report by the end of the year.
There is a proposal from the Home Office to legislate for a “protect” duty. This is primarily about terrorism, but it raises all sorts of issues about how, particularly, public venues are able to respond to incidents. I think that would be very valuable.
Some of it can be done without that. I was concerned about the state of schools and how they would deal with an attack or an incident. Schools are used to having fire drills and evacuation procedures, but in certain sorts of attack that is the exact opposite of what you want—you do not want the children coming out and standing in the playground because that is where they are vulnerable, so you ought to have an invacuation plan. I suggested that you did not need legislation but could have guidance that every school should have a designated governor for security who would need to think through these things. I think there are things you can do without legislation.
For other bits, it is perfectly within the powers of government; they just have not got around to it. Public alert technology, whereby you would get a precise message in the event of an incident or a warning, has been available for over a decade. It has saved huge numbers of lives in India, in Australia and so on. When I reported in 2016, there had been five years of drift since the Cabinet Office had trialled a system. Five years later, it is still drifting.
I believe, but nobody will acknowledge it, that there was a public trial in, I think, Reading, a few months ago. Now I am told that there are going to be a couple more public trials. This is technology that exists elsewhere in the world, is rolled out, and—for example, in the case of the Grenfell Tower fire—would have enabled people to have sent a message to every mobile device inside the tower telling the residents that the evacuation protocol had changed. But it was not available; it could not be done.
In fact, the Cabinet Office is not trialling a system that would enable you to know how many mobile devices were switched on in Grenfell Tower, had you used it, and to then observe later how many had moved and acted on it, so you would begin to know where there were people who were trapped. This technology is there. Why are we not moving with it? It is this inertia—who is responsible, who is going to pay?
The Chair: We must not forget that we have Professor Collins available to answer questions as well.
Q240 Viscount Thurso: Lord Chairman, I was going to start with Professor Collins. I was ahead of you there, but thank you very much indeed.
Professor Collins, may I come to you first? What are the key takeaways from your recent report, Resilience Reimagined: a Practical Guide for Organisations, particularly those for government? I have in mind what you said in your first answer—that the biggest risk is our not being prepared and that government operated in silos. Perhaps you would like to expand on that.
Professor Brian Collins: While recognising that the Lord Chair is breathing on the clock, there are three things I would like to say. One is to ensure that what we do is much more outcome focused rather than input limited. Of course there will be limits on budgets, but we need to understand the outcomes that are needed and move towards a way in which we organise this. Lord Willetts will recognise what I am about to say. If you do that in a mission-oriented way, and focus all the activities of the players who are needed to be at the party on delivering on that mission, you are much more likely to produce a coherent outcome that is risk resilient—in other words, a common purpose.
For me, succinctly, what we come away with is organising yourself to deliver a set of outcomes that make a difference, in the right place, and then organising yourself to deliver all the actors that are needed, whether you control them or influence them, to achieve that.
Viscount Thurso: Specifically with regard to government—and I am going to stick with you for the question—Lord Harris pointed out that, if you take the Secretary of State for Transport as an example, he probably does a three or four-year term, boots the problem down the road and then the next guy has to worry about it and takes the same approach. How does one pull all the Government’s responsibilities together, so that there is somebody who actually is in charge of all this?
Professor Brian Collins: I mentioned earlier a report that I wrote with Sir Mark Walport, who was director of the Wellcome Trust at the time, in 2009, which eventually caused the National Infrastructure Commission to be created through the Treasury. The Treasury is the one place everything comes together, for financial reasons, but it also comes together increasingly because it influences national policy on aspects where big public money is at risk. That was why it was prepared, eventually, to create the National Infrastructure Commission.
I think that there is a model there, which is pre-empting the last question that we might be asked, about creating a national risk and resilience commission along the lines that has been created for the National Infrastructure Commission—it is a broader church, of course. There would then be a body at arm’s length, but not totally at arm’s length—the length of the arm is critical—which does the joining up of all the actors and holds the feet to the fire, especially if there is some legality involved, of both regulators and Parliament to deliver on “joined-upness”.
Viscount Thurso: And make the Chief Secretary to the Treasury the Minister responsible for it.
Professor Brian Collins: Quite possibly.
The Chair: That would be an amusing way of getting the Treasury in front of us to give evidence.
Q241 Lord Rees of Ludlow: We now get the “Desert Island Discs” question, where we want a simple and short answer about one policy recommendation that the committee should make in our report to the Government. Professor Collins, you have more or less said what your recommendation is. Will you repeat that briefly, perhaps?
Professor Brian Collins: Indeed. If there was a commission along the lines of, and a combination of in some ways, the climate change committee and the National Infrastructure Commission—not the detail of it but the structure and purpose—that would go a long way to causing Governments of any colour, into the future, to deliver a joined-up solution to better risk management and better resilience for the nation.
Lord Rees of Ludlow: Lord Harris, what is your suggestion?
Lord Harris of Haringey: I do not think that there is a single silver bullet. If you do not beef up the Chief Secretary of the Treasury, you have to beef up the Cabinet Office and ensure that it has that reach.
The other big point is to look at your regulatory mechanisms. What is going to drive things through the system is ensuring that the regulatory system operates that. The banking sector—the finance sector—has taken on board the need for operational resilience, as well as simply financial, but most of the other regulators for the big areas of infrastructure simply look at price. They are not looking at resilience at the same time, and that is going to become increasingly important.
The Chair: Thank you both very much indeed. We are only one minute adrift. I would like to thank you for doing much of our work for us. We will be paying close attention over the coming months to the National Preparedness Commission, and we are most grateful.