When John Quinn arrived, the organisation had a single outsourcing deal that was over 12 years old, two releases a year for change (fixing problems created by the previous releases), a poor understanding of IT, a team with rock-bottom morale that had been sidelined in favour of the supplier, and a defeated internal user base and frustrated external customer base. Since then, all of that has changed. He has created an operational transformation programme with the themes of regulatory optimisation, customer experience, data and knowledge management to drive business reform, and the delivery of cloud-based platforms, infrastructure and service improvement. Job titleCIO and SIRO Company nameMHRA How are you influencing the products, customer experience and services your organisation offers to its customers?I have been in post for three years. When I arrived, MHRA had a single outsourcing deal with Accenture that was over 12 years old, two releases a year for change (fixing problems created by the previous releases), a low understanding of our products and services, systems with hard-wired processes baked in and coded down to the line, a team with rock-bottom morale that had been sidelined in favour of the supplier, and a defeated internal user base and frustrated external customer base. Something had to change. Over the past three years, I have changed how the organisation thinks about how it regulates. While the things we do are currently the same, our view of the customer and our expectations of the services we provide are now exciting and gaining momentum. What started as a technology strategy then became a digital strategy, and over the past year, as the recognition of what I am delivering has developed, is now an operating model reform strategy. I have established an operational transformation programme with the themes of regulatory optimisation, customer experience, data and knowledge management that will drive business reform, and foundational service to deliver new cloud-based platforms, infrastructure and service improvement. With 21 programmes now in flight, we are now in the middle of what we are describing in our team as total digital change. I have built excellent executive sponsorship for the work, and there is a strong appetite to use the investment opportunity to transform our business. This has taken on an added dimension with Brexit, which presents a range of risks and opportunities for the agency and its future global role. Define the key business outcomes that you have delivered over the last 12 months and their impact on your organisation’s performanceSecuring executive buy-in from our board has been key, and we have introduced a strong benefits model that focuses on payback and outcomes, but securing buy-in and confidence in a shared vision was crucial. We are midway through delivery, and a few highlights from the past 12 months include: Implemented ServiceNow, and in so doing built a previously absent CMDB, so we can now manage delivery and control it, leading to faster, cheaper delivery and maintenance. We can now hold our suppliers to account. Moved our entire infrastructure, breaking up our Accenture infrastructure into six SME suppliers, reducing our costs by 20% and improving our services. Implemented 24 sprints (we are now on sprint 44), which is 20 more releases a year than customers are used to, at lower cost, faster pace and a very low error rate. Insourced ownership of our direction from Accenture, who had a free hand for many years. We now directly manage enterprise architecture, security, PPM, design and analysis, and have built a strong commercial and service management capability. I have secured £60m worth of investment. While many projects are due to deliver over the next 12 months, we have secured confidence, sponsorship, momentum and commitment from the business on our analysis, design and delivery. Cyber and information assurance was very low, with audits finding us with limited ratings. However, a recent audit has shown significant improvement and control, allowing management of information risk, with a positive moderate rating just awarded. Delivered a full remediation programme of our ‘mess’ of an infrastructure, which has managed risk and improved service availability. Office 365 is currently being rolled out, with productivity, information management and collaborative working benefits being delivered. Implemented new laptops replacing eight-year-old kit, with a single image and controlled by SCCM. Critically, we have now matured our governance and processes, enabling us to manage and report on delivery, which has built confidence across the team and stakeholders. What has been your involvement with innovation at your organisation – in particular, with products, business model and technology – over the last 12 months? Product innovation: The agency did not really have a service or product view of what it delivered. We have undertaken extensive work on service design as part of understanding our processes in order to redesign our services. As a way of understanding the scale, in our discovery phase on applications we found over 500 applications, major duplication, data silos – if a technology existed, we probably had it. In helping the business units understand their services, we have started to help them consider how they can take their services and products and use the operational transformation programme to create new products, many of which are now delivered through our sprints. Business model innovation: As above, we are blending a process-mapping approach with user journey to redesign services. While this activity is currently under way as we move from infrastructure and platform delivery into business services, the business design work is also under way. A current example will be the design of the new British pharmacopeia service, which is a 150-year-old service; through user design and business canvas modelling, we have got them to think about developing a whole new product and business model, moving it from a paper and electronic copy product to a platform ambition to service our customers. Technology innovation: We are replacing the majority of our services and technology over a six-year period. We are delivering a range of cloud platforms to replace our estate. While we have an Azure environment, many of our services sit on AWS as SaaS products, linked by microservices. I have selected Appian, Mulesoft and Tibco platforms, together with a move to Oracle Fusion for ERP by April 2017. O365 is currently being released and Power BI will be in the next 12 months. By applying design patterns we expect to move from producing low-level designs to using patterns for 70% of activity in the next six months. How have you delivered cultural and behavioural change as a CIO within the IT department and/or more broadly across the organisation?Operational transformation scope goes beyond digital delivery, and changes the way we run our business. We have recognised that to inspire and model that change, we had to first model it for the organisation. We moved to a different working style with benches instead of modular desks, and a 15-minute rule to allow for high turnover of desk usage that has created a buzz and supported collaborative cross-team working. Our walls are covered in drawings, we hold standups rather than meetings, and we have a ‘blocker’ walkthrough once a week to support our programmes. This has not gone unnoticed in the wider organisation, and others are picking up on our standups and output-focused meetings. While we have implemented strong project documentation, we are keen that it must be of service and focused on decisions and actions rather than documenting everything, which is a feature of our scientific organisation. Our programmes have a strong brand and communications standard, and we have bought in user-focused design and agile ways of working that are nothing sort of revolutionary for our organisation. While none of this sounds particularly new in our field, our customers and stakeholders take a rightly critical and evidence-based approach, given the Accenture years, and strong scepticism around technology. They will remain suspicious until it’s all done, but they recognise that it is this strategy and range of projects that will deliver the reform, and allow us to change to adopt the future regulatory challenges that digital health technologies will bring. How have you worked with your CEO and/or board to communicate whatever ‘digital’ and IT means to your organisation/sector and improve digital literacy at the highest levels of the organisation?Buy-in and support is essential. By delivering early wins, we have seen confidence grow. Over the past year I have run four workshops with the executive team. They began with our analysis, included an innovation day with acted out scenarios on our future success and failures, identified success criteria, got buy-in to assign owners and challengers among the executive team around eight priorities, and the final workshop connected the outputs with the programmes that we developed from the ground up. The key concern of the CEO was how to make this future thinking ‘concrete’ in delivery plans. The actual challenge has been to show how bottom-up and top-down connect. Golden threads are difficult, so we’ve just run a procurement to provide some external challenge to get further buy-in, but the key measure of trust in our vision and delivery has been in getting approval for our business cases after rigorous review. Our non-execs have provided additional challenge and support, but feedback has been really good. We are clear on how business value and reform will be enabled through operational transformation, and how we will measure success and business outcomes as we progress. As we have delivered, confidence has grown, but will become even more critical to the agency as we respond to Brexit. How have you worked with the technology and IT vendor market to achieve your business goals? How have you been able to influence IT suppliers and successfully manage your partnerships/relationships with large IT companies, SMEs and startups?While moving from a single outsourcing supplier of many years standing is always a challenge, we have made significant strides. We now have 20-plus suppliers in our stables, and have worked hard to secure buy-in to our mission and strategy. Some examples below: Accenture:I have been critical of the company, and we spent over a year in a very difficult relationship. I refused to pay it for the first three months until I had more visibility on what I was paying for. Over a period of time we changed the account team and removed Accenture from our infrastructure domain. However, we have three more years of outsourcing for applications support on our legacy services that we have to maintain and manage the trick of maintaining integration as we flip to the cloud. While I no longer use Accenture for delivering new services, we have turned the relationship around and it will manage the applications estate of old and new until the contract expires. I am in the process of negotiating targets for reducing legacy and supporting new services. Redrock/FDM:I have used these suppliers significantly to break the Accenture stranglehold, bringing in better expertise at half the price. While my aim is to make the case for fully insourcing to civil servants, the pay and benefits and paucity of skilled labour means I cannot wait for conditions to change and have had to shake things up. The balance is now shifting back to insourcing, but early buy-in and support to get me the best professionals was a strategic supplier discussion that has paid dividends. Oracle:OK, I know this does not sound very SME, but bear with me. We have a huge Oracle 11i estate, with ERP hardwired into our case management system. While my initial discovery was with a small startup called ERPaaS, it became clear we needed a bit more backup to get our ERP out to the cloud. I made the call that a move to cloud first was the right one, and negotiated directly with Oracle to undertake the delivery rather than an integrator. We will go live with Oracle Fusion in April on the public cloud. Appian, Mulesoft, Tibco:They supply our MDM, ESB, API and processing platforms, and I invest my time heavily in getting buy-in and support for delivery. These suppliers in particular are where much of my focus is. As well as the recognisable names, we’re doing plenty with SMEs such as digital agencies, RPA implantation and supporting services to productivity solutions. As we mature, and get through the hump of delivery, I’d expect us to begin to turn the lights on with services on our platforms, which will bring smaller and niche players into the market. Our Wardley map shows lots of work on commodity at present, but the moonshots and development will come in the next couple of years. How have you tried to develop the diversity of your team?When I started I took a baseline of skills in the team. I worked with GDS on the alpha of digital skills while at DfE, and built on it with Blackthorn at the MHRA before it was further developed and released by GDS. It was clear from external assessment that the skills were at a low baseline. I then asked the team to assess themselves – they were not as far apart as you might imagine. The team were not capable of delivering the reform that I had the ambition to deliver. I had two options, to replace the team and spend a painful year doing it, or invest in them to see if they could make it. While as a pure business decision, losing a year was not great, I believed that this team had been sidelined, with no investment in it, and was fed up with the GDS-sponsored view of the world that bought in contractors rather than invest in existing teams. Over the past three years, I’ve invested heavily in team development, skills development, succession planning, good hires and building a team that represents the community I live in. I live in London N15 in Tottenham, the most diverse postcode in the country. All my life I’ve encouraged and supported people who didn’t get the best start, and my team reflects that. Our values and behaviours reflect that, and we are proud of the mix of our team. As we are a civil service organisation, we sometimes take this for granted, but we make it clear to our suppliers up front that we expect them to behave as we do. Describe how you organise and operate IT and how this aligns effectively with business strategy and operationsWe are going through a few phases and have an op model that reflects our current phase. It is one that many in IT would recognise, and we have delivered a couple of reform projects with the various lenses of people, process, organisation, information and technology views: business office: strategy, performance management, MI digital delivery group: architecture, analysis, design, PPM, data, KM, infosecurity, service design service and commercial management: service management, introduction, commercial management, scientific system, applications support, networks. We also have a multivendor environment of outsourced suppliers. We have described this as a retained SIAM organisation, as we don’t believe you can outsource responsibility to a third party. Once our platforms are delivered and multiple services are live, we are considering making a further change and insourcing development. What strategic technology deals have you made in the last year and who are your main suppliers and IT partners?We let contracts mainly through G-cloud and manage them directly and continuously, which is the strategy: Service Now Cortex FDM Glue reply Commonwealth RedAnt Blue Prism Reading Room Sunguard HP NTT data Redrock Exponential E Microsoft Appian Mulesoft Oracle Accenture Cognizant. What are your key strategic aims for next year? Define the post-Brexit operating model of the agency enabled by implementation of our digital strategy. Deliver all the replatforming projects that are scheduled. Develop an international health regulatory platform service to allow the agency to provide services across the globe. Develop my team. Tell others what we are doing (this application is part of it). How are you preparing for any impacts Brexit might have on your organisation?The MHRA is part of a Europe-wide medicines regulatory system. We provide around 40% of work in Europe for medicines and medical devices, so leaving Europe poses some major issues for access to medicines in both Europe and in the UK, whatever the outcome. I already provide services to other European countries that rely on our technology products. There are various options, ranging from becoming a full sovereign regulator to a more scaled-back role. However, the appetite and expertise in the agency, which already has a first-class international reputation, is to continue to play a part of medicine, medical device and biological safety. The growth of digital health technologies represents a challenge to regulators around the globe. The role of my team in advising the agency on the response to digital technologies, the role we have enabling the agency to provide services on a modern cloud-based scalable platform, and the strong focus we have on data standardisation across different nomenclatures affords us a unique opportunity to make a major contribution to the mission of the MHRA, and the future role of the UK in life sciences. YOUR ROLE When did you start your current role?February 2014 What is your reporting line?Chief operating officer Are you a member of the executive leadership?Yes Are you a member of the board of directors?Yes How often do you meet with your organisation’s CEO or equivalent?Weekly How many people at your organisation does your function supply services to?1,300 BUDGETS What is your annual IT budget, or your spend as a proportion of the organisation’s revenue?£12m annual for run, plus £60m currently approved for change. We are using our surplus to invest in reforming our agency. What percentage of your budget is operational spend (ie keeping the lights on) and how much new development (ie innovation, R&D, exploratory IT)?The £12m run includes a service improvement programme of roughly £2m a year. CIO INFLUENCES Rank the following sources of advice/information in order of importance: Industry bodies CIO peers Consultants Analyst houses Media IT SECURITY Has your organisation detected a cyber intrusion in the last 12 months?Yes Are you expecting an increase in budget specific to security in order to tackle the cyber threat?Yes Does your organisation have a designated security professional – CISO or otherwise – and what is their relationship to you?Yes – reports to me RECRUITMENT Are you finding it difficult to recruit the talent you need to drive transformation?Yes Has recruitment and retention risen up your agenda as a CIO?Yes Does your IT organisation operate an apprenticeship scheme?Yes How many employees are there in your IT team?50 in the team, and 140 people from SME service suppliers. Are you increasing your headcount or planning to bring skills and the ability to react to needs in-house?Yes TECHNOLOGY Which technologies or areas are you expecting to be investing in over the next year? cloud data analytics/business intelligence ERP CRM datacentre/infrastructure/server IoT security AR/VR enterprise applications machine learning/artificial intelligence social devices (mobile) devices (desktop). Which technologies or areas are you expecting to be investing in over the next one to three years? cloud data analytics/business intelligence ERP CRM datacentre/infrastructure/server IoT security AR/VR enterprise applications machine learning/artificial intelligence social devices (mobile) devices (desktop) networking/communications. What emerging technologies are you investigating or expect to have a big impact on your sector or organisation?IoT and digital health. We regulate medical devices, and many new AI and digital health products require regulation. We are now providing internal support to the devices team to help them understand how to regulate these emerging technologies. THE EU Does your organisation do a significant amount of trade with the EU?Yes Does your department include technology staff from the EU?Yes Are you or have you been looking to the EU to recruit key skills?No