Part 6 of The State of DHCW. The striking feature of the evidence is the recurrence of identical language across eight years and two organisations: 'overly positive' reporting in 2018 becomes 'optimism bias' in 2026. Four mechanisms explain the persistence — accountability without authority, annual funding, optimism under incentive, concurrency beyond capacity. And a structural finding proved from DHCW's own audited senior-managers definition: there is no technology executive on the board, no published review has ever tested for one, and the Welsh Government has twice had to import digital expertise from outside.
Part 6 of The State of DHCW. Numbered citations resolve at the sources page.
The striking feature of this evidence base is not any single failure but the recurrence of identical language across eight years and two organisations. “Overly positive” reporting (2018) becomes “optimism bias” (2026). “A lack of clarity as to responsibility for delivering the intended benefits” (2018) becomes “limited benefits realisation despite sustained investment” (2026). “Deep concerns about the capacity of the leadership team to deliver the scale of change required” (2018) becomes “capacity and capability not aligned to portfolio scale and complexity” (2026). Reorganisation did not resolve any of these.
Four mechanisms recur across the documents and, taken together, explain the persistence better than any account resting on individual failure.
- Accountability without authority. DHCW is answerable for national programme delivery but cannot mandate adoption, sequencing or local readiness. When asked in 2022 who was responsible for incentivising WCCIS uptake, DHCW answered “a collective responsibility” — which the Senedd committees rejected as inadequate assurance.[22] The Welsh Government’s 2026 finding that de-escalation requires “less reliance on Welsh Government brokerage to secure adoption or commitment”[1] is an acknowledgement that brokerage is currently the only lever. Audit Wales’s advice — that DHCW should stop reporting “problems outside of DHCW’s control” and focus on what it controls[12] — is reasonable governance advice that does not close the underlying gap.
- Annual money against multi-year programmes. Non-recurrent funding blocks long-term hiring and medium-term planning[12]; the NDR lost 27% of a phase’s funding in-year[39]; Connecting Care was established unfunded[13]; and savings targets are met partly by leaving posts vacant.[12] A delivery organisation cannot build durable capability on annual allocations, and then gets criticised for depending on contractors.
- Optimism as an institutional survival strategy. Where funding is annual and contingent on demonstrated progress, there is a standing incentive to report confidence. The 2018 finding of “overly positive” reporting, the 2023 warning against “over-optimism,” and the 2026 finding that “cultural factors appear to inhibit early, open reporting of delivery risk” describe the same adaptive behaviour under the same incentives. Behaviour of this kind is not corrected by exhortation; the Welsh Government’s own de-escalation criteria implicitly accept this by requiring structural fixes — “clear thresholds for pause, reset or stop agreed and demonstrably used” and “decisions taken where confidence is low (including reprioritisation or de-scoping).”[1]
- Concurrency beyond capacity. DHCW ran the LIMS and PACS national replacements simultaneously, in a compressed timetable, having inherited both mid-flight and needing to remediate both — which it concedes “was not the original intention.”[4] The Welsh Government notes that “persistent underperformance across multiple programmes absorb[s] disproportionate senior leadership attention,” reducing capacity to prevent the next failure.[1] That is a self-reinforcing loop, and escalation activity itself consumes the capacity needed to escape it: “enhanced monitoring and escalation activity absorbed senior and specialist capacity, reducing the organisation’s ability to proactively support recovery in other at-risk programmes.”[1]
Assessment. On the documented record, the criticism of DHCW's delivery is well-founded and is now the settled view of the Welsh Government, the Auditor General and two Senedd committees. The criticism of its leadership is real but narrower than sometimes implied: it concerns realism, risk escalation, benefits discipline and key-person dependency — not probity, transparency or financial control, where DHCW performs well.
The more uncomfortable conclusion is that the 2021 reorganisation was treated as the remedy when it was only a change of container. The Level 4 intervention explicitly targets "programme management, governance, organisational culture and leadership."[1] If the Phase 1 diagnostic stops at DHCW's internal culture and does not also address the authority gap, the funding cycle and the concurrency of the portfolio, there is little in this eight-year record to suggest the outcome will differ from 2018 or 2021.
Capability at the top: the missing technology function
A common explanation for DHCW’s record is that its leadership lacks technical depth. That proposition needs splitting in two, because one version is unevidenced and the other is strongly evidenced.
What cannot responsibly be asserted is that named individual directors lack competence. No published audit, ministerial or parliamentary document makes that finding, no one’s professional history is assessed here, and the Welsh Government’s own Level 4 diagnosis attributes failure to behaviours and capacity rather than to ignorance — “insufficient delivery grip and realism in leadership behaviours,” “capacity and capability not aligned to portfolio scale and complexity.”[1] DHCW also reports that “about 70% of our people are technical, including software engineers, data analysts and digital architects,”[4] and runs over a hundred operational services at 99.97% availability[67] — not the normal output of a technically illiterate organisation.
What is evidenced, and materially more useful, is structural: DHCW has no technology executive on its board. Its own 2025–26 board composition, signed by the Chief Executive, lists eight executive and director posts:[65]
| Board-level executive / director posts, 31 March 2026 | Domain |
|---|---|
| Chief Executive Officer | General |
| Executive Director of Finance (interim) | Finance |
| Executive Director of Strategy | Strategy / policy |
| Executive Director of Operations | Service operations |
| Executive Medical Director | Clinical |
| Director of People & Organisational Development | HR |
| Board Secretary | Governance |
| Director of Primary, Community & Mental Health Digital Services | Service line |
| No Chief Technology Officer, Chief Information Officer, Chief Digital Officer, chief architect or chief engineer | Absent |
This is confirmed independently by the audited remuneration disclosures, which are the authoritative record of who holds decision-making authority. DHCW defines its “senior managers” as “those persons in senior positions having authority or responsibility for directing or controlling the major activities of the NHS body … those who influence the decisions of the entity as a whole rather than the decisions of individual directorates or departments.”[84] Across the two most recent years, that group comprised the Chief Executive, Directors of Finance, Strategy, Operations, People, Primary Care and Mental Health, the Executive Medical Director and the Board Secretary — and in neither year does it contain a Chief Technology Officer, Chief Product Officer, Chief Digital Officer, Chief Architect or equivalent.[84]
Chief-level technology titles do exist at DHCW — a Chief Information Security Officer and a Chief Cloud Officer appear in Audit and Assurance Committee attendance lists — but they attend as officers, below that tier.[40][61] On DHCW’s own definition, therefore, its most senior technology roles are not among those who “influence the decisions of the entity as a whole.” Meanwhile the system-level Chief Digital Officer recommended by the 2019 Digital Governance Review sits in Welsh Government, not DHCW.[6] National digital architecture consequently had no owner with decision rights inside the body responsible for delivering it.
The assurance route reinforces the point rather than compensating for it. Technical architecture is scrutinised by the Technical Design Authority, which “reviews the technical architecture of products requiring assurance, providing expert validation to” the Wales Informatics Assurance Group “as part of the approval process.”[4] Both are advisory assurance functions that feed approval and report to committee as “assurance” items.[72] Technical expertise in this structure advises; it does not decide, and it holds no veto.
Four further pieces of evidence point the same way:
- The one formal board skills review looked for clinical experience, not technical depth. Audit Wales in 2024: “a recent skills review identified limited clinical experience amongst current members. This poses a relatively low risk,” with the Chair, CEO and Board Secretary “considering options to ensure a greater clinical voice.”[13] No published skills review has tested engineering, architecture or large-programme technical capability at board level. That is an absence of scrutiny, not a clean bill of health.
- Welsh Government twice concluded the technical capability had to be imported. The May 2025 framework lists among Welsh Government’s own responsibilities the “appointment of external digital expert to support DHCW on critical enablers relating to digital services.”[2] Announcing the escalation, Jeremy Miles said the expert would “provide an independent assessment of DHCW’s ability to deliver.”[54] DHCW’s own committee then recorded that this “had brought additional technical insight and knowledge via constructive challenge which was welcomed.”[61] An organisation with sufficient technical authority in the room does not need that supplied by its sponsor.
- The core technical thinking was outsourced. For the National Target Architecture, DHCW “procured an architecture repository solution” and “procured an external consultancy” which produced the current-state assessment, the architectural principles, the target state and the roadmaps.[78] The Integration Hub was built by a “hybrid team” with an external delivery partner, and DHCW could not onboard its own staff onto it — “delays in onboarding internal staff … due to upskilling required,” with recruitment needed to “backfill delivery partner colleagues.”[77]
- The 2018 precedent was never closed out. The Public Accounts Committee found of NWIS and the wider NHS digital team: “We did not see sufficient evidence of a deep level of Technological or Digital understanding and little evidence that the benefits of Cloud computing are being fully identified,” and recommended “a review of the senior leadership capacity in terms of skillset and governance.”[21] No published document evidences that skillset review having been completed for DHCW’s board.
Judgement. On the documented record, technical capability at the top is a significant contributing cause, but the sharper formulation is not "the directors don't understand technology" — it is that no one at board level owns technical architecture and has the standing to say no. That distinction matters because it explains the specific shape of the failures.
The signature decisions in this record are not coding failures. They are architecture-literacy and commercial-technical failures of exactly the kind a strong CTO function exists to prevent: sequencing six national application programmes ahead of the integration layer and architecture that would have to carry them (Part 2); a RISP master services agreement that let each organisation unilaterally move its own go-live date in a tightly sequenced national rollout;[4] maternity procurement requirements "disproportionate compared with what the market could realistically provide";[71] running the national laboratory and radiology replacements concurrently, which DHCW concedes "was not the original intention";[4] and eleven major incidents from inadequate change impact assessment whose root cause "had yet to be thoroughly examined."[71]
It also explains the optimism bias the Welsh Government keeps naming. Optimism survives in rooms where nobody has both the technical grasp and the authority to contradict it. That is a governance design fault, and it compounds the authority gap above: DHCW lacks the power to direct adopters and lacks a board-level technical owner to sequence the work properly in the first place.
Stated limit: the board-composition gap and the imported-expertise findings are documented facts. The causal weight placed on them here is an inference from structure and outcomes, not a finding any audit or ministerial document has made.
Technical authority: four propositions tested against the record
A recurring account from people who have worked with or observed DHCW closely is more specific than “the leadership isn’t technical.” It holds that sound technical judgement is overridden; that ambition is untethered from engineering reality; and that the organisation does not trust its own technical staff. Those are causal claims about behaviour, and they are testable — not by assessing individuals, which this record does not do, but by asking whether the documents show the fingerprints such behaviour would leave. On four of the propositions they do.
| Proposition | What the public record shows | Verdict |
|---|---|---|
| Technical control gates are bypassed | The 2023–24 risk-based audit of change management recorded "Major = 6 … Minor = 1" non-compliances / non-conformities, among them "No verification or risk acceptance criteria required on implementation of emergency changes" — such that "potentially a change with any risk rating can be approved by a Change Manager" — and "Security controls are not defined."[42] The 2025 thematic review's corrective actions read as an inventory of gates that were not being held: "Enforce technical peer reviews for all Major and Significant change activity"; "Deviations from SOPs must be fully assessed, and all work must follow the correct change category"; "Avoid normal working hours when performing high-risk changes such as failover testing"; "rigorously test all changes in controlled, non-production environments — including performance validation"; "urgent risks escalated through the e-CAB process"; "All security-related changes must be formally logged and tightly access-controlled."[71] Eleven major incidents in twelve months followed from "inadequate impact assessments," and the root cause — "the application of the change management process by teams" — "had yet to be thoroughly examined."[71] | Corroborated. Verification and risk-acceptance criteria exist precisely to stop unqualified sign-off; the audit found none were required on emergency changes. |
| Ambition outruns engineering reality | DHCW described the concurrent LIMS and PACS replacements as "the largest and most ambitious digital diagnostics replacement programme in Europe" — in the same document that concedes both required remediation, one required a change of supplier, the implementation phase was "heavily compressed," and running them simultaneously "was not the original intention."[4] The Welsh Government names "optimism bias" and "late challenge"; the Senedd warned in 2023 against "over-optimism"; the Auditor General found NWIS "overly positive" in 2018, when its host chief executive "described its ambitions as world leading" against 21 outages in six months.[1][22][21] Recruitment was booked as a "Resolved Area of Concern" on a time-to-hire KPI while a second audit of the same area was still running.[63] | Corroborated as a documented, twenty-year institutional pattern of stated ambition exceeding delivered capability. |
| Staff are not trusted or listened to | Confidence that DHCW would address a concern fell from 84.8% to 59.2% in one year; those feeling safe to speak up from 84.8% to 62.8%.[47][64] Three whistleblowing investigations concerned "values and behaviours and processes being adhered to."[60] Board minutes record "challenges … particularly around burnout and the need for stronger leadership, visibility and development opportunities"; days lost to stress and anxiety reached 5,209; an independent member questioned whether declining appraisal rates — down for a third consecutive period — correlated with burnout.[37][65][70] Welsh Government cites "cultural factors [that] inhibit early, open reporting of delivery risk" and "over-reliance on key individuals," naming "specific programme, clinical safety and architecture leads."[1] | Corroborated. A workforce that reports it is unsafe to speak up, and a centre that reports risk surfacing late, are the same finding seen from both ends. |
| Leadership is drawn from public administration rather than engineering | DHCW's own appointment announcement establishes an entirely internal career: the Chief Executive "has worked in NHS Wales for 30 years and has held several key leadership roles in the field of data and informatics," progressing from Assistant Director of Information at Abertawe Bro Morgannwg Health Board, to Director of Information at NWIS, to interim Director of NWIS and interim CEO of DHCW, to substantive CEO.[7] The same announcement records that as NWIS Director of Information she was "leading on the development of the new National Data Resource – the NDR."[7] The Executive Director of Strategy is recorded as seconded from Welsh Government; the interim Executive Director of Finance came from Swansea Bay UHB.[46][38] On every executive post whose provenance is publicly documented, the career path is internal to NHS Wales or the Welsh Government; none is documented as coming from engineering or software delivery, and — more to the point — no post is defined as such. DHCW publishes no machine-readable board biographies, and no published skills review has assessed engineering or architecture capability at board level.[13] | Corroborated for provenance — on DHCW's own account, a 30-year career wholly within NHS Wales. Individual qualifications are not publicly established and are not assessed here. |
One consequence of that continuity deserves separate note. The National Data Resource — the programme that lost 27% of a phase’s funding in-year,[39] that DHCW named as one of three drivers of the March 2025 escalation,[4] that missed seven of thirteen quarterly milestones in late 2025,[77] and that by May 2026 was pulling an entire strategic mission down to Amber/Red[72] — is the same programme DHCW’s announcement credits its future Chief Executive with “leading on the development of” while Director of Information at NWIS.[7] Its architecture premise has therefore been owned by the same person from origination at the predecessor body through to accountability for its escalated state, across roughly nine years and one reorganisation. That is not a criticism of any individual’s work; it is an observation about the absence of a break point. At no stage has anyone from outside that lineage held the authority to test whether the programme’s founding design was sound — which is precisely the function the missing board technology role would perform, and precisely what Welsh Government has twice had to buy in from outside instead.[2][54]
On evidence and its limits. Three of the four propositions above are corroborated by DHCW's own audits, board papers and staff surveys, and by Welsh Government's escalation findings. That is as far as public documents can take the argument, and it is further than might be expected: an organisation whose emergency-change process required no "verification or risk acceptance criteria" at all, whose technical peer reviews had to be re-mandated, and whose staff confidence in being heard fell 25 points in a year, is one where the record is consistent with technical judgement being overridden rather than heeded.
What this record does not assert is that any named director lacks competence, holds no relevant qualification, or is motivated by status. Those claims concern identifiable individuals and are not established by any public document, so they are not made here. The structural finding does the same analytical work and cannot be dismissed: there is no technology executive on this board, no published review has ever tested for one, and the Welsh Government has twice had to import digital expertise from outside to assess an organisation whose sole purpose is digital delivery.