Report finds ‘process failures’ at the Skills Funding Agency
An investigation into secret changes to a government website has unearthed “process failures” and an inability to pinpoint who made the unauthorised adjustments to data.
The views are made in a breach report, published by UK Statistics Authority into the FE Choices website, which is managed by the Data Service; part of the Skills Funding Agency.
As revealed by FE Week in March, an investigation by the Agency found nearly 2,700 changes were made to “unique values” in the Learner Satisfaction indicator of the site, without public knowledge, after it went live on January 26.
This affected 442 providers, with 62 providers unaffected. However, while the Authority’s report lifts the lid on how it occurred, it was unable to identify who made the changes.
The Authority’s report says: “The SFA have examined available email and other electronic records, and interviewed staff, but are unable to identify who made or authorised these changes, or uploaded the revised data file as around 45 staff had access to the site used to feed the updates to the external web manager.”
It also tells of a “reorganisation of the FE Choices data team” from April 2011, which placed them under the auspices of the Data Service. Transition and incorporation on to Data Service protocols is still in progress.
As soon as the Agency received reliable intelligence that a problem had occurred, they took immediate action by uploading position statements on the FE Choices webpage and began a thorough investigation
The report says: “A number of process failures have been identified relating to a lack of data backup procedures, failure to follow the required version control procedures, sign-off procedures which did not require statistician approval, and resourcing, including dependence on contingent workers and high levels of staff
turnover during the reorganisation.
“All these issues are limited to the FE Choices system and processes, and do not extend to other SFA statistical outputs.”
The report also highlights that the Agency became aware of “further changes” to FE Choices during their investigation.
After the FE Choices data was published, data in the Learner Satisfaction indicator was subsequently corrected on February 6.
This was reported by a “former SFA contingent worker” in a letter to John Hayes, minister for further education, skills and lifelong learning, and copied to the National Statistician, which was received on 21 February 2012.
It was also communicated to FE Week.
The report adds: “The Agency added a notice to their website alerting users to a potential problem on 21 February 2012. While investigating the reported change, further changes that had been made to the data came to light.
These were a revision to the treatment of zero values, correction of a coding error relating to questions 6 and 7, and the exclusion of data relating to large employers who train their own staff.
“These changes should also have been announced at the same time as the changes were implemented, and information made available about the nature of the changes.”
In response, the Agency has implemented measures that it says will stop a reoccurrence of this incident in the future.
These include improving existing “change control process to restrict the number of people able to upload web changes to the feeder site to two” and that all changes must now be approved by a GSS statistician.
The Agency has also “tightened” existing procedure to ensure full records are kept of any changes or revisions, so that an “audit trail” exists.
A longer term plan includes improved documentation of process, and improved testing of code and data to allow “more time, more automated testing, and adequate ring-fenced resources” between website and data projects.
The Authority’s report also says although permanent staff within the Agency are aware of the Code of Practice, not all “contingent workers” are. A refresh of this knowledge is planned.
An Agency statement reads: “As soon as the Agency received reliable intelligence that a problem had occurred, they took immediate action by uploading position statements on the FE Choices webpage and began a thorough investigation.
“Once the Agency had conducted their investigation, they communicated findings (on FE Choices) and began implementing processes, which we are confident will aim to prevent any reoccurrence of this singular incident.”