Part 5: Working towards a world-class system through continuous improvement

5.1
In this Part, we discuss:

• the attributes of the world-class system that DPMC aspires to;
• The National Security System displays some of the attributes of a world-class system; and
• the main improvements that can be made to move the System closer to world class.

Summary of our findings

5.2
DPMC aspires to have a world-class national security system. The System currently displays some of the characteristics of a world-class system. For example, the System is able to quickly mobilise a network of people and has clear frameworks in place to manage the response to national security events and emergencies.

5.3
DPMC is making ongoing improvements to the System towards making it world class. Further improvements could be made. Information flows, particularly for classified information, need to be improved throughout the System. The resilience of the System needs to be supported by better identification and transfer of institutional knowledge, and more systematic induction of people coming into the System.

The attributes of a world-class system

5.4
At the beginning of our audit, DPMC asked us to measure the System against a world-class standard. DPMC intends the System to be world class and seen as effective, efficient, and trusted by the officials involved in it and the Ministers who receive advice from it. DPMC sees a world-class system as enabling decision-makers to identify and respond appropriately to the national security issues confronting New Zealand.

5.5
National security systems throughout the world operate differently, and there is no obvious world-class standard for a national security system. However, there are many examples of what best practice looks like. Based on experiences here and overseas, DPMC identified that a world-class national security system is:

• resilient, forward-looking, risk-based, and able to learn lessons and adapt accordingly;
• swift in how it responds – it can mobilise partnerships and move information quickly;
• adaptable to events that are unexpected and/or complex;
• supported by good processes but has a degree of flexibility and is able to cope with a variety of responses;
• effective when making decisions in a strategic context;
• able to draw on good information quickly to promote understanding; and
• efficient in how it uses leadership effort and includes prioritisation mechanisms that make best use of resources.

The National Security System displays some of the attributes of a world-class system

5.6
The System currently displays some of the characteristics of a world-class system. For example, New Zealand is a small, well-connected nation, and the System is able to quickly mobilise a network of people. The System also has clear frameworks in place to manage crises, such as Watch Groups, ODESC, and the use of the Coordinated Incident Management System.⁶

5.7
New Zealand also applies elements of best practice in managing crises, such as "red teaming". Red teaming involves a multi-agency team subjecting a plan, ideas, and assumptions to rigorous analysis and challenge to improve the validity and quality of the final plan. This was used during Operation Concord. During this response, the response team also completed analysis of similar events internationally and sought advice from international partners to help with the response.

5.8
DPMC is making ongoing improvements to the System, both on the response side and the strategic side. Examples of continuous improvement include:

• defining risks to provide sharper focus and a forward-looking, proactive perspective for governance of national security risks and resilience-building;
• introducing the National Exercise Programme to prepare the System for responding to critical risks, including debriefing meetings after exercises and activations of the response side of the System, and work the Directorate intends to do to be more systematic in identifying, recording, and applying lessons from these debriefings;
• publication of the National Security System Handbook to improve understanding of how the System operates and roles in it, and other procedural improvements introduced by the Directorate; and
• the all-of-government strategic communications function, recently introduced to improve strategic communication during an event. The function helps the lead agency by managing the strategic communications, leaving the lead agency to focus on operational communications.

Moving the National Security System closer to world class

5.9
Although the System is evolving and maturing, further improvements could be made for it to be world class. These should strengthen the resilience of the System and enable it to operate in a seamless and sustained way.

Information flows throughout the System can be improved

5.10
Effective governance on both the response and the strategic sides of the System requires relevant information to flow efficiently between the different people involved.

5.11
We saw examples of good information flow on the response side of the System when examining our two examples. In both examples, information flowed from lead agencies into Watch Groups, and between Watch Groups and ODESC. Information was also shared to provide co-ordinated advice to Ministers. Although there were issues with information flows very early in the Operation Concord response, these were quickly sorted out.

5.12
On the strategic side of the System, meeting minutes also showed that relevant information flowed between ODESC(G) and the boards, and to the boards from subgroups, within the limitations of unclear accountabilities.

5.13
However, information (both classified and non-classified) does not always flow efficiently on either the response or the strategic side of the System. Directorate staff told us that they consider that this is the biggest issue to resolve for the System to be more effective. Many people we spoke to also told us that information does not always flow well throughout the System.

5.14
Although there is scope to improve the flow of non-classified information through the System, the flow of classified information is of particular issue. Classified information is information that people can access only if they have a specific level of security clearance.

5.15
There are several barriers to the easy and effective flow of classified information:

• the lack of a simple way to transmit classified information that all people with the appropriate clearance are able to access, and no consolidated information repository that everyone with the appropriate level of security clearance can access;
• limited staff throughout the System with appropriate clearances to access classified information, which is a particular problem for some agencies; and
• the current manual process for confirming that people attending meetings and receiving information have the appropriate security clearance, which is labour-intensive and trust-based, and could be simpler and more efficient. Work is under way to find a solution for this.

5.16
As well as the issue of how classified information flows through the System, the Directorate has recognised that the way information flows from the boards to agencies on the strategic side of the System can be constrained. The Directorate is seeking to improve these information flows with several new initiatives. For example, the Directorate has recently started sending out a weekly "all hazards" update, which provides situational awareness throughout government.

Better knowledge management and induction to the System

5.17
The System relies on the institutional knowledge and established relationships of an experienced network of people. That network changes over time as people move in and out of the System.

5.18
Sustained and seamless operation of the System needs to be supported by better capture and transfer of institutional knowledge, such as knowledge of the circumstances or scenarios the System has responded to, and how it has responded, in the past. This would provide a "knowledge bank" that people in the System could draw on where relevant in future responses.

5.19
How people are inducted, trained, and developed in their roles in the System also needs to be more methodical. One person we interviewed described induction to the System, and understanding their role in it, as learning "by osmosis". Recently developed, tertiary-led officials' courses provide people with a useful introduction to the System. These courses are run several times a year. More methodical induction and development to build on this training is needed to bring people into the System quickly and effectively.

5.20
Given the recent changes to the architecture of the System, the diagram depicting the System needs to be updated, including the names of some of the boards so that people can clearly distinguish them and their roles.

6: As described in the National Security System Handbook, New Zealand's "Coordinated Incident Management System" (CIMS) is a framework of consistent principles, structures, functions, processes and terminology that agencies can apply in an emergency response. It enables agencies to plan for, train and conduct responses in a consistent manner, without being prescriptive. CIMS relates to the management of a response; the ODESC structure sits above this if the situation is significant or complex enough to demand a coordinated strategic response at the national level.