Wales COVID-19 Inquiry Special Purpose Committee

Yes. My name is Rowena Hill. I'm a professor of resilience, emergencies and disaster science at Nottingham Trent University.

I'm Richard Pickford, manager for Nottingham Civic Exchange, also at NTU.

Thank you, both, very much for being here this morning. I really appreciate your time and your expertise as well. Can I ask that Members are succinct, as we go through, because we've got a lot to cover and not very much time to cover it. And that applies to me first, because I'm kicking off. Can you provide an overview of the key elements of best practice in civil contingencies planning?

We can. We have prepared a slide deck, if you'd like us to take you through that.

Oh, sorry. We'll start with that.

We'll show you that now.

Hopefully that will come up on the screen. There we go.

So, we were just going to run through a series of pieces [Correction: 'slides']. What we've been asked to do is to give you a history and structures of civil contingencies across the UK, with a bit of a deep-dive then into the variations in Wales, thinking about what's different, with some final conclusions on preparedness around the pandemic, and what was prepared and what was thought. So, we've got, as I say, a little bit of an agenda in terms of those. So, we'll outline civil contingencies, disasters and emergencies response, we'll talk about those key principles to remember, and think about when we're thinking about civil contingencies across the United Kingdom, and where and how those are different in Wales. We'll talk a little bit about some of those changes during and after COVID-19, and then some very quick thoughts on the inquiry, and a little bit of information around the pandemic and what was done and changed, before opening up for any questions from that, if that's okay.

So, first up, we're going to talk a little bit about some history, if that's okay.

So, I think it's helpful with the civil contingencies range of activities to think about these as quite complex areas that aren't given a lot of stable attention [Correction: 'consistent attention']. I think that's the best way of putting it, because the civil contingency structures, obviously, stand up when there's something to manage, and then they stand down again. So, when we're looking at how emergency management operates within the UK, there's a set of pre-agreed overall structures, and some of that is the Civil Contingencies Act 2004. There have been some updates since then, in the pandemic, as Richard suggests, but, mostly, those activities and the practices within them are focused around managing those emergencies—so, acute emergencies. Recently, we're moving into the management of chronic risks, and that's some of the learning that we'll come on to later on in our slide deck from the learning from COVID.

But I tend to think of this as a bit of a cinderella policy. So, the attention, I think, when they're there is really heavy and very focused, because, a lot of the time, it's a bit of a life-and-death situation, and then, when they are disrupted or when there's something that's not quite working, or isn't as effective as it could be, either in the decision-making flows or in the communication flows, that's where we see some of those fracture points emerging. So, what they tend to do is they tend to map onto a set of response activities and also a set of recovery activities that happen and are enacted both at national level, at UK-wide level and also at the local tiers as well. And so, you can see that emergency life cycle there at the bottom, which is put in as an illustration—that, during the pandemic, that was slightly different to what we had experienced before in our more acute emergency management approaches or experiences. In that, we had response and recovery running simultaneously, going in and out of activation. So, with some of the aspects that we'll talk about later on, I think it's just quite helpful to think through that.

Also, we've got that figure at the bottom that talks about the emergency life cycle. But, obviously, there's a bigger set of aspects that sit around that, and activities that sit around that, which different groups have responsibility for. So, one comes before that, which is around the preparedness and understanding of risk, how we understand that, the methodologies for figuring that out, what we're preparing for and how we're preparing, how we're training, how we're exercising. And then, after that acute phase of managing whatever it is that we're managing—in this case, we're talking about the pandemic—there's also a set of learning reflections, and then implementation and updates following those experiences of learning.

So, we just wanted to set that in a little bit of context for you—that, although a lot of the discussion we'll talk about focuses on things like the Civil Contingencies Act, there's a broad range of resilience structures that sit around that.

So, just moving on to the Civil Contingencies Act itself, seen, really, in two parts, the first is around the principles and structures—so, what's actually there, what's needed, what goes on. The second part is thinking about emergency powers. When we think about Wales, Part 2 is a retained piece, so that happens within the UK Government. But that whole point of the structures, the mechanisms, how you identify, plan, prepare, is put there in Part 1, and there is obviously a detailed range of framework structures and agreements that exist within this.

Obviously, in 2018, there was a transfer of powers, so a number of those principles and structures became devolved to Wales at that point, and you’ll see on the Welsh Government and the Government website the piece of legislation and the framework for how that is developed alongside a concordat. So, that develops that opportunity, really, to understand it. But it’s really about understanding how we manage this in a structured, systematic way, what do we need to do to allow us to be prepared and to develop, and having that system. Because previous to that, the view was we were doing this okay, but not in a way that would really help us constantly, continually, and there were a number of historical incidents, both in terms of flooding and other emergencies, that meant the UK Government thought we’d need to do something about this. Now, it took a number of years, but the Civil Contingencies Act is really the key piece, and there’s lots that has moved on since then, which we’ll cover after that.

So, moving on, what we want to show is just to give you a sense of how some of these things are thought about when we’re developing and thinking about decisions. Emergencies and disasters happen all the time in the UK and often we don’t hear about them; they don’t get talked about. You have them in that kind of green box, in terms of that local response. If something happens locally, it is managed often by the fire and rescue service or by the police, or if it’s a health emergency it’s managed by the health system. Those often are developed quite locally. There can be a level of mutual aid, cross-border support, multi-agency support, but they can be quite small. When those grow into that kind of regional level, almost as you see in that graphic, we see a larger, more combined development, and you get something called LGD, a lead government department, which takes on a responsibility to manage that disaster and emergency. And then, as those things become bigger, whether that’s a cross-regional emergency or even a national or an international incident, those grow, and different levels of the system, effectively, come into play and start acting. What we saw through the pandemic was a new set of emergency powers and issues coming in with the Coronavirus Act 2020, which changed the way that this was developed, which we’ll talk about later.

Next, we just wanted to share with you some graphical representations, I suppose, of the system. We realise these are really small, and we’re not asking you to be able to define and look at the graphic, so don’t worry about that, but they’re there for your record and so, if you do want to go back to them, they’re there as a bit of a resource. The blue on the left is the main UK Government system and how that works. Those in the shaded box are new assets you might see—so, we’ve got the national situation centre, and then some specific groups that were set up to work under SAGE, the Scientific Advisory Group for Emergencies, especially for the pandemic. So, those are new groups. But what we have is that UK response system in red. You’ll see nodes that are based and are working around security and risk, so, things like the National Security Council, the national security risk assessment, which has been updated, and then down the bottom in that kind of yellow area you see the local response—so, local resilience forums, which we’ll talk about next.

If we zoom in, what you can see is a series of acronyms, and you can play acronym bingo in the civil contingencies world until the cows come home. But all of this is run, or is set up to run, through this idea of subsidiarity. People at the most local level are there and they can see and experience what is going on on the ground, and therefore they should be making decisions about what needs to happen in the next 20 minutes, 20 hours, 20 days, to make this a disaster and manage that. And they’re supported by something called the strategic co-ordinating group, which is managed by someone in gold command, either from a police, fire or health position. When those are set up and an emergency is called, there is also something called a strategic co-ordinating group, which looks at and is exploring what needs to happen to get us back to normal, to stabilise that, and that is often led by a local authority kind of position.

Underneath that, you’ve got something called a TCG, which is a tactical co-ordinating group, which really does the job of organising and managing and getting information, often on the ground, to bring that in. You’ve then got something called a STAC, which is a scientific technical advisory cell. So, if there’s some really technical information about the emergency, whether that’s something to do with nuclear or flooding or extraction rates, then they are tasked with working out those figures and sharing that. This all works on a kind of battle rhythm, and a lot of the terminology is quite militaristic in terms of developing and understanding information that goes in. Often this will run through situational awareness—sitreps, you'll hear talked about—where information is fed into that strategic group to help them make decisions, and action logs are kept of those things.

One of the new things that came in was the multi-agency information cells, which was the idea of gathering that information, often with military support, to develop and help when we needed more information, more capacity. And there are other cells that get created. So, we've got, obviously, a media advisory cell, which would be helping the LRF communicate both to partners and agencies, but also to the general public, about what was going on, what people needed to do. But the SCG can also set up other cells. So, through the pandemic, you had personal protective equipment cells, you had all sorts of other groups where you needed a group of people to really think about something. So, often people would get hived off from that LRF space to do that. Within the LRF, one of the things we've not talked about here, but it's in the briefing, is that list of category 1 and category 2 responders, which are people who have, within the legislation, a responsibility to be involved in this, and the list is there for you to see within that space.

What we move on to, then, is that UK system, often run through COBR, the Cabinet Office briefing rooms, run by the Cabinet Office, and then the resilience and recovery directorate, RED. Those are those decision-making spaces where information comes in and is shared and developed. As I said, there are some new things that have come in—so, the national situation centre, and then also SPI-B and SPI-M, which are those scientific groups that work within SAGE to ask specific questions. So, when people talk about modelling, it was the SPI-M group doing that, and often with a very academic focus, very academic backgrounds, doing that work, providing information that is then used and translated for decision makers in that space.

One of the pieces you see within this is that there is a range of interconnected nodes that play a role. One of the key ones between the local and the national are Government liaison officers, known as GLOs, and they sit and report between those, so that should be that bidirectional communication space between those. You've also got resilience advisers as well, who do some of that work. So, you can see that they fit into that space.

One of the interesting things that's come post pandemic is the national situation centre, which, as you can see, as far as we're aware, doesn't really have that bidirectional flow. It is for the UK Government, it is for understanding that [Correction: 'it is for that level of government']. That information, as far as we've seen so far, fits into the UK Government and doesn't yet go down to the local resilience forums; it isn't briefing local resilience forums on the information it is working out and developing, which is something we've been exploring and talking about within our work. I'll just hand back over to Rowena to talk about some of the principles and things that embed this and talk about this.

Hopefully now we're moving towards some of the answers to some of the questions that you pose. So, what makes all of this work? We've covered the structures that try to manage some of these emergencies and the response. Particularly in the pandemic, those structures were stood up. There are eight guiding principles for effective response and recovery that the doctrine talks about across the different policy areas and also across different frameworks that operate.

When we look at these, anticipation is around good understanding of what are the likely and possible risks that we face within the UK. And it's not only what is the likelihood of those happening; we've seen, over the past six years, a real move in our risk assessments to understanding what are the consequences. So, instead of it being more probability based, it's also now looking at what are the impacts, particularly on aspects such as groups that are vulnerable or at risk.

There's also preparedness—how are we actually preparing for managing those risks, what do those different needs look like with regard to our response, and also our recovery from those risks. And within risk, we're talking about both hazards and threats there. Hazards are more natural-based occurrences, and threats are more human-protagonist risks. Preparedness is looking at things like training, exercising, making sure that the people who are within those structures managing the emergency know what they're doing, how they're doing it, how they're communicating and what are the decisions that they might need to work through, and how they're making those decisions.

One of the big principles, I think, is around subsidiarity and we see this across both Europe and other parts of the globe. A lot of their civil contingencies and civil protection is based on that principle of subsidiarity. So that's the principle of the highest level of co-ordination and the lowest level of decision making, and we saw during the pandemic that this was flipped somewhat in the Coronavirus Act.

Also, on direction, whether that's at a UK level, a Welsh level or a local resilience forum level, there is a principle that there will be some strategic aims that are set to work towards, and so all of that decision making by those different structures that we talked about earlier on will be aligned with one shared aspect. Usually that's about reducing harm, saving lives and making sure that we can recover in a way that encourages maximum human flourishing.

There's also information. This was a bit of a challenge, I think, during the COVID pandemic, just purely because we needed a lot of it. In the UK, compared to other countries—particularly I'm thinking here about places like Canada, for example—our information and data structures weren't necessarily set up to respond to a whole-of-system emergency or whole-of-system threat. So, it's information going up to decision makers, information being passed between different levels of governance structures and different levels of decision making. Certainly from our own data collection and understanding of how the pandemic was going, we knew that information was a real struggle for those making those decisions.

Also, there's integration. That's around how our system coheses [Correction: 'works'] as a whole in that kind of civil protection and civil contingencies world. There's the aspect of co-operation as well. That's not only about mutual aid between different geographical boundaries, for example, but that's also around co-operation between the different levels of decision making. And then, also, there's continuity. That's that piece around the fact that the management of the emergency and the response decision making shouldn't be done first, before our efforts are moved to recovery. So, recovery is really important, obviously, for our communities and for those that are sitting within different leadership roles such as our public services. So, it's how do we make sure that that continuity happens. And that's not just about business as usual; that's also around progression to returning back to normal or building a new normal.

One of the principles is around, 'Are you learning?'. Mostly around civil contingencies there will be a period after something has happened when we pause and reflect and run debriefs. And you'll see most exercises also have this as well. So that's the way that we transport our learning from either geographical areas or between different risks so that we can start learning agnostic of place or risk. How those principles are carried out, what those barriers to anything were and identifying that, and then understanding how that can be moved between different risks, is something that we focus on traditionally in that life cycle.

What we did during COVID, and one of the reasons I believe that you've asked us here today, is that we were part of the COVID-19 national foresight group. During that time we ran three—we couldn't call them debriefs, because obviously the pandemic went on for quite a while—interim operational reviews. We went out across the UK to all those different decision makers and people involved in those different structures that we talked about earlier on in the presentation, and we asked them what was going well, what did they think they needed in order to carry on and what did they think was probably the most threatened. Those reports can be found online. They're publicly available, I believe. We've included the links for you. I think some of those points on the exchange between those different structures come out within those reports and identify areas where, actually, learning might be able to focus.

Obviously, the greatest mechanism for learning that we have is the COVID-19 inquiry, hence why it's going to be covering so many different modules. With the depth that that's offering so far, having seen module 1 and module 2, we have a real opportunity for doing that. And it's great that we're here today with you, who are part of that mechanism—so, a personal sense of joy there for our learning, because we do need to learn.

So, what does good look like? There are a number of different documents that aggregate what that looks like within that ecosystem of civil protection and civil contingencies and the different structures there. You can see that we've highlighted one of these different reports around the expectations of good practice, and that's particularly aimed at category 1 and category 2 responders. They have different levels of statutory obligation that are contained within the Civil Contingencies Act 2004, and that really does highlight the expectations. The other document that we will point you to around what good looks like is the 'Concept of Operations', which sets out what the UK Government's 'good' might look like within those different experiences of emergency management. And through that document, if we just click over, you'll see that it does highlight good practice and leading practice in there.

Moving on to talk a little bit about Wales, the summary, really quickly, is the same but different in terms of the Act, in terms of what's there, but there are significant variations, in part because it operates on the same sort of footprint. We're talking here about a policing footprint, so those local resilience forums operate on the same policing footprint as we have here in Wales. But obviously, those are Home Office related; the Home Secretary has responsibility. So that's where the variation and challenge comes in. If we go back and think about that visual of the scale of an emergency, those smaller scale emergencies are often managed independently within those LRF footprints, and therefore, they're controlled in that way.

When we go to much larger scale emergencies, whether that's an oil spill on the coast, whether that's some issue with nuclear power, whether that's a roving counter-terrorism issue or, as we saw with the pandemic, something that happens across the globe and certainly across the UK and has that issue, that's where those retained powers play in and that responsibility comes from the UK Government to manage and deal with that. And that's where Wales has a role in terms of co-ordinating, gathering data and telling that story, but doesn't necessarily have a lot of those decision-making powers within that space, especially, as we saw in the pandemic, with a health emergency, where NHS England takes that role, within the Department of Health and Social Care, to manage that. But what we see in Wales is that strategic and operational groups are there, both in the pan-Wales response plan and the emergency co-ordinating centre, but then also the Wales civil contingencies committee. Those governmental and parliamentary spaces to manage and think about it are there in existence and are managing and running it.

But it does create a challenge when you've got that cross-regional and cross-border piece, which is something that we found in some of the work that we did. It's where you have those issues of where regulations are varying and different, and that's where it creates that tension, because who is responsible and where is not highly clear, because there is an interconnected web of different players making decisions, within the general civil contingencies space and also between Wales and England, or Scotland and England in the same way as well. So, it does create that challenge. Obviously, Wales has got responsibility for its own training and development, so preparing Wales, the Civil Contingencies Act in Wales, is there as a kind of Welsh response; they have power to change, adapt and shape that. But there is still an element of, 'That needs to be cleared by the UK Government' on a number of those factors. So, it was challenging to be clear and it challenged everyone in this space, I think, when we're talking about what this looks like.

Moving on, one of the things we wanted to show and talk to you about very briefly was the structures that have been shared within the inquiry—again, a very complicated graphic. But effectively, this was the expected way that the Welsh preparedness and response structures would work in Wales in 2019. This is what they were expecting. What you can see in these lovely crayoned drawings of mine that you can see is the Welsh-specific civil contingencies elements within this. And, obviously, then, the variation in the Welsh health system, with local health boards, means that it was different to how you might imagine it from, certainly, our context, living in England, being a different system. So, you've got those communication challenges to be made between those in terms of people needing to understand, 'Oh, it's not the same as what I expect to see. What are these health boards? I don't understand what a health board quite does. Does it do the same thing?' Who makes decisions, the named individuals and the roles, therefore, can be different, so it creates, often, challenges in that space.

When we move on and talk about the general UK civil contingency space, you can see there's even more going on in this space, partly because you have a lead Government department for the pandemic, which would be, for the UK, the Department for Health and Social Care, which sits in the middle, and everything working underneath it. Now, in some ways, that's all great and it's all there and written down, but we were preparing for a different sort of pandemic, and so a lot of the exercises—well, some of them—were thinking about a coronavirus pandemic and other types of pandemics. The most recent and the most common thinking was it was probably going to be going to be something like influenza, and therefore that faces and creates a series of things that you think about how you are going to deal with it. What that meant is, because we weren't talking about a regional, local or small-scale issue, a lot of new things got brought in. So, that idea of subsidiarity gets slightly turned on its head, because decision making starts being made at much higher levels, either at regional, at some points, but then at UK national level, which changes the way this works. You have new things built and set up, like the Joint Biosecurity Centre, the COVID-19 taskforce, but then also processes and systems like local outbreak management plans, which change the way these decisions are made and add another layer of complexity into an already complex system, we'd argue.

Just for the record, there is a key for this in terms of what all those lines mean, if you really want to get into the detail, but, effectively, most of them are around reporting lines, communication lines and what other people were doing in this space. But the general thing to keep in mind is that there is a lead Government department that takes responsibility and has that lead for it, but you could argue they had slightly less control when it goes to that kind of global level. So, moving on to some of those changes.

So, changes, post-pandemic, which we were aware you might be interested in as well: there are two main aspects that have come since the pandemic. One is a series of integrated reviews by Boris Johnson, and also Rishi Sunak, and then that led to and informed the resilience framework. The resilience framework is something that goes beyond the Civil Contingencies Act 2004, which was also reviewed in this period between the start and the World Health Organization declaring the end of the pandemic. Essentially, the review of that framework came back with that not many changes were needed, because the resilience framework was coming, and then, shortly after, the resilience framework was launched.

So, this is looking at that whole ecosystem approach, and if we remember back to that emergency life-cycle, where I said, actually, there are things that go on before, things that go on after, of the resilience life-cycle, it tries to aim to implement and strengthen those wider perspectives. So, in there are things like how we understand risk and the transition in thinking from risk around a more probability-based aspect to including consequence management; responsibility and accountability, how our accountability lines are managed across the UK, and there was a particular English focus with the resilience framework, but I'll come back to the Wales resilience review in a bit. It also focused on partnership, so, how our community and voluntary partnerships are involved and included in our emergency planning, our civil contingencies planning, particularly our recovery. Traditionally, they were much more included in our recovery work, but, actually, involving them in also our response and also in that pre-work as well, we recognise, is good and leading practice. Also the investment within our structures—so, in the pandemic, for example, we were asking our local resilience forums to do quite a lot of work regarding things like securing and procuring PPE. Local resilience forums at that point in time were a partnership, so they had statutory duties that they were expected to deliver, but they actually didn't necessarily have a legal entity, and so all of those things became quite difficult and challenging for them to do, so that was trying to address that. And also skills—so, the skills and the competencies, things like standards of what good and leading emergency planning and emergency management looked like. The resilience framework tried to address some of those aspects as well.

It also incorporated a wider set of UK-related aspects, such as things like our national cyber security plan, the climate change risk assessments, because, obviously, these are all very heavily interlinked aspects, and also things like our supply chains resilience framework as well. So, it tried to make a what once was a relatively emergency managed focused set of principles and guidance and doctrine encompass a much more civil protection and emergency management position.

Whilst that was going on, the Welsh Government undertook a review of civil contingencies governance structures in Wales and found related themes: so, aspects around governance and assurance, how the risk ownership and understanding were established in the beginning in order for us to then plan and prepare an exercise against; the inclusion of consequence planning; the nature, people, pace and plans for things like exercising and learning; and also the whole of society approach, which I'll talk about just briefly, if that's okay. The whole of society approach is something that has been led by the UNDRR, so that’s United Nations Disaster Risk Reduction group, and, essentially, it is based on the premise that, as our world is becoming much more interconnected and much more complex, what we find is relatively geographically based emergencies tend to have much more of a ripple and consequence effect than we typically used to have, say, 30 to 40 years ago, because of that nature of interconnectedness.

We also know that the landscape in which a lot of our public services find themselves is that there is a higher demand than necessarily the resources they particularly have at that point in time to manage that higher level of ripples and cascades. We also are aware as well that our learning since the 1980s onwards is that, when an emergency happens, and we then go back to those communities that were involved in that emergency or that disaster and ask how we performed as a group of individuals managing that emergency, the premise of ‘done to’ rather than ‘done with’ is quite a consistent finding. And so the whole of society approach, the premise of that, is that our responsibility as a community, as a nation, as a country, as a globe, is that we all have responsibility within the management, the identification and the response to managing those risks. So, it builds on the premise that both governmental structures, private entities, public services, community and voluntary sectors and all of those different structures that we talked about earlier on all have a role in how we understand and how we prepare and how we recover from risk.

So, the whole of society approach is something that is trying to be much more inclusive and collaborative in co-production of that civil contingencies protection and civil contingencies aspect. And so, what we have is an approach that the local resilience forums are being encouraged to take, that impact assessments are undertaken within the communities that they are responsible for looking after the civil contingencies aspects for. So, things like understanding how the nature of different risks might impact on different groups, different communities, is something that I think that whole of society approach is really keen to understand. So, they're the main changes, post pandemic.

So, next, we're going to talk very briefly about the inquiry. Obviously, we don't really need to tell you what's going on and what it looks like. We've popped a link in there, so you can see it. But, obviously, there are six current active modules under way with that inquiry at the moment. So, looking, as they have already, at resilience and preparedness; that core UK decision making and political governance; they're obviously now under way talking to Scotland, and they'll be coming to Wales in a couple of weeks' time. And those other bits are there under way in the background being researched, explored and developed with the team that's working on those. And there are a number of future modules, as you can see there, looking at testing and tracing; Government and business; health inequalities and the impact of COVID, which we've done a little bit of work on as well; and then thinking about other public services.

So, there is a wide variety, and this is really broad and thinking about what we can do. What we wanted to do, obviously, is talk you through, very briefly, that first module, as that's the one that you'll encounter first, if that makes sense, with the expectation that findings will come soon.

So, the first one is around resilience and preparedness. I never understand whether it's 'prepared-ness' or 'preparedness', but whichever way. So, this one opened on 21 July 2022, and this is looking at that whole system of civil emergency. So, it's looking at resourcing, it's looking at risk management and also pandemic readiness, as well as planning. So, that's why we've front-loaded a lot of that slide deck to try and enable you to access quite quickly where those points of that module 1 might focus, and why the technical nature of module 1 gets quite detailed into the nuance of where are those decisions happening, where were they supposed to be happening, how did the Coronavirus Act 2020 change that, how do those different wiring diagrams that Rich presented earlier on, did that actually happen, because a plan is great on paper, but does it survive first contact I think is really where a lot of module 1 is really focusing on. So, those findings will be coming later on this year.

So, when we're looking at the pandemic readiness, the scope of the inquiry is asking: was the risk of a coronavirus pandemic properly identified and planned for? And was the UK ready for such an eventuality? I think, if we're honest, the question in my view and my opinion for No. 1, 'Was the risk identified?', it absolutely was. It's been in that risk assessment framework that we've been working on for the best part of 15 years. So, it has been the most likely.

Was the UK ready for such an eventuality? I think the nature of how—. And this is where a lot of the questioning around module 1 has been focused: were we planning for a pandemic or were we planning for an influenza pandemic? And that becomes a real point of contention. I think what we were doing was that we were planning for an influenza pandemic, and so what we have is a deep-dive into a lot of those different planning exercises, Cygnus being one of them; there's also a whole swathe of them. We can give you some information if you'd like. In particular, I think maybe five are relevant. But they were focusing on aspects of things like, 'If this is a health emergency, how—?' So, one of the international exercises, for example, was: how are we managing our labs to co-learn around pathogen development? So, how are we passing the pathogen between our labs internationally and how are we accumulating that learning?

Of course, when we separate out those exercises into those different approaches to see how parts of the system are ready for a pandemic, and particularly an influenza pandemic, what it does is it moves away from consequence management. So, it moves away from things like, in the language in the inquiry and, before that, in the management of the pandemic, for non-pharmaceutical interventions, how are we exercising children not being at school for a while—for months, in fact—how are we understanding how Treasury support might interact with the support that benefit systems might need to alter. All of those aspects of a whole-system impact weren't necessarily part of that training and exercising. One, because, 'How do we design an exercise that would appropriately do that?', I think, was some of the challenge, and also, some of the challenge was the assumption, I think, that because it was a health emergency, it would be particularly related to health, led by health and recovered from by health. And actually, where we look at those kinds of cross-society impacts, they weren't necessarily included in all of those and the interconnectivity wasn't included in some of those exercising.

So, if we just move on: I think, in summary, the lessons learnt weren't always followed through to completion. The exercising became partial in order to try and, you know, eat the elephant. There were parts of that elephant that were exercised in different parts, but we didn't necessarily see it as the elephant—and I'll stop with the elephant analogy now. And also, we exercised certain activities, so things like body storage or the sharing of lab tests, as I say, but not necessarily how those all operate together.

We did tend to, in those exercises, look at things like involving, say, 5,000 people across the UK in some of those, but we didn't necessarily go beyond our emergency management structures. So, 'How would society respond and how would we have that ongoing relationship with our communities for a sustained period of time?', they weren't necessarily involved in those. And also, mostly, we exercised influenza, not a novel virus that we didn't necessarily have a pharmaceutical-base intervention to go with it. So, that's where all those complications—well, not complications, but the non-pharmaceutical intervention became a challenge for us.

The other aspect that I think has come out in the inquiry, and also came out from our findings when we went to those people responsible for managing the emergency through the pandemic, is that they were coming off the back of an extraordinarily large amount of work—as I'm sure the people that we're talking to now can tell us more about that than we can—around the distraction that the EU transition work provided. That isn't to downplay that work that needed to be done, but that is the reality, that a lot of our preparedness work was on hold, while all of those different systems that we talked about at the beginning of the presentation were actually part of that management process, so that if something didn't necessarily happen in the way that it was meant to with the EU transition, they would be the people responsible for managing a lot of those emergencies that followed from that. So, the EU transition took up a lot of energy and airtime, and I think it's worth just highlighting that.

One of the things that I think is quite a long read—and I say this having the utmost professional respect for them both, having worked with them both—is there was an expert report produced by Professor David Alexander and Bruce Mann that I think really captures a lot of this. They did a deep dive into all of the different evidence submitted for module 1. Ultimately, they had kind of three main conclusions, that the influence of pandemic preparedness was poor; the response strategy should have been tested; and preparedness for a novel infectious disease pandemic was inadequate.

The second one, we definitely tried to pick up during the pandemic. There were exercising and planning strategies set up, so that we could understand, as the pandemic was unfolding, how those different emergency management structures were trying to learn, as we were going along at pace. The plans that they were developing, they were trying to do things like peer review in order to see whether the plan would survive the first test. So, there's a lot of learning that was done in situ, but we just wanted to outline for you the landscape, so that we could focus maybe more on some of those areas in the questioning that you have priority for. Sorry, Chair, I hope that's okay.

Thank you very much for your presentation. A really, really interesting, fascinating presentation. Loads of strands there that I think all of us—I could see nodding heads in the room—were kind of thinking of going down. I'm very conscious of time as well; we've only got about 10 minutes for questions. The list of questions I had, you have covered, so I won't go back over old ground, so I'll go to Vikki first.

Thank you. You've covered some of my questions, so I'll try to be brief. First of all to ask how well you think existing civil contingency plans were designed to adapt to any unforeseen challenges and emerging threats.

So, I think, from my experience of working with the civil contingencies at local level, which is most of my experience, and recently at a national level—or UK-wide, should I say—I think plans are basically built agnostic of risk, which is the best plan, and the same with the preparedness. So, built in is that flexibility to try and understand how something might unfold, as well as what might be unforeseen, so that we aren't necessarily having plans and preparedness that are too detailed. And, I think, that was a real bone of contention that I saw in module 1, around how detailed should a plan be, how detailed should our preparedness be for risk. Because if we're planning for that risk and it doesn't quite unfold in the way that we're expecting, then the ability for us to move and bend and flex with the flow needs to be built into that.

So, I think, at the moment, we do it as well as we possibly could do, bearing in mind that we're humans and we're relatively uncomfortable with uncertainty. Having built that into the system, we seem to be at that right balance between flex and preparedness.

Thank you. And, just very quickly, you've outlined those eight guiding principles of effective response and recovery, but, in your view, out of those, which would be the key ones to consider in a comprehensive risk assessment of civil contingencies?

I think it would be consequence management.

Okay.

Okay. Thank you very much. Jack.

Thank you, Chair. Thank you, both, for coming in. Chair, I think we've covered the co-ordination of response, what the response to a civil contingencies emergency has been. So, if it's okay, I'll move to a couple of questions on future—

Yes.

Thank you. And, again, I think the inquiry will cover off—. I think it was just yesterday that Michael Gove was talking about the Civil Contingencies Act in the Scottish module. Within the structure, we've got the Welsh civil contingencies response structure to the pandemic in front of us. We've had lots of discussion this morning already. Do you think that public health bodies in Wales are integrated into both the national and local response to planning, to ensure that effective readiness of preparedness, whether it's a civil contingencies emergency or whether it's a public health emergency, as current? If we were to look at this—I'm conscious of the screen and that you can't see that, but it's the one with the drawing on—that's the expected operational plan. Are public health bodies and local health bodies in Wales adequately represented in there?

I think they may argue they are adequately represented, but were they as integrated and connected as they could be? I think, from the work that we've done—and there's some work that we've done that's marked 'official sensitive', so we can't talk about it publicly—the view is that they could be better connected. But that exists within that network, as we've talked about before: all of these places could be better connected, and it's knowing who and when. And, I think, talking about the agnostic risk challenge, it's knowing when and how. The real challenge is knowing the people you need to go and speak to, when suddenly you need to go and speak to them, and that's really critical. So, a lot of that conversation is a making friends in peacetime kind of narrative, of knowing who you need to talk to and building up those relationships, so that when something happens, if it's a pandemic or something's coming down the M4, a kind of flu pandemic, you can see it coming, because public health are measuring that happening. It's knowing the right person to pick up the phone to and go, 'Is it going to be next week, or it is going to be in four days' time?'

If you don't have those relationships, because you've not practiced, you've not been through that, it becomes really difficult. And the challenge we saw was, then, when new things are added on, in terms of new structures and systems, there are other people you speak to and you don't even know who they are—so, who's this person joining this meeting, who's this person engaged in that—and it becomes quite difficult. So, I think, they're built into the system in a way that means that they should work, but that's the system versus reality, and the more you practice, the more you build relationships, the better that can be, I suppose.

Thank you. And just one final question, because I'm conscious as well and pretty sure that the structure will get real scrutiny during the inquiry when it comes, towards the end of the month, but just in terms of preparedness, what sorts of questions would you expect the inquiry to ask? Part of our role as a committee is to find any gaps that the inquiry hasn't quite covered, Welsh-specific issues. If the inquiry doesn't ask them, what sorts of questions should we as a committee be asking, in terms of preparedness and planning for future contingencies?

I think, for me, it would be how the Welsh structure is moving on and where its direction of travel might be, considering the changes at UK level. Because the resilience framework is quite open to where devolved administrations might move with that. And, from the learning from COVID-19, I would want to see where those two align and where they need to be different, I think.

That's very useful. Diolch.

Adam is next.

I'd like to turn the clock back now to the period running up to the pandemic. I don't know how familiar you are with the actual Welsh plans and documents and the evidence that has been presented so far. You mentioned the exercises and the various exercises that happen, so, in Wales, Cygnus, there was a double-dip, if you like, in 2014 and 2016—bits of it were run separately. There were debrief reports in relation to both of those exercises, effectively. Based on what you've read, were the recommendations incorporated in the various policy documents, the pan-response plan, the influenza framework document for Wales? Based on what you've seen, were the recommendations incorporated in those policy statements?

I think they are, and what we see from that documentation, particularly from module 1 and others that I'm aware of, is you see the articulation—and this is coming back to your question—you see the recommendations at UK-wide level being really grabbed by Wales, and then articulated, nuanced and connected directly back into your structures really well. There is a clear audit trail of that, in my view.

There were other relevant exercises, weren't there? You mentioned that one of the key themes has been the emphasis on influenza to the exclusion of other possibilities. There was one exercise on a coronavirus, wasn't there?

There were five main ones from about 2017 onwards, looking at different types of pandemics. From memory, one was about swine flu, one was a type of coronavirus pandemic—

Severe acute respiratory syndrome, yes.

Yes, certainly SARS. But they're often looking at specific things. So, if there is a SARS piece, how do we test the global lab system? So, they're often not taking that global, holistic, whole view of it, so they're not—. In a way, Cygnus probably had the most system-wide view of it. Those other ones often had quite a specific focus on a particular aspect of how do we prepare, how do we manage, how do we deal with it.

And, again, for that excercise that did focus on a coronavirus, was there a Wales-specific debrief? And, the recommendations, did they flow into changes in terms of the policy framework too?

From memory, and I reserve the right to update you to say, 'I've gone away and checked on this', from memory, I believe there was.

One of the recommendations from the 2016 debrief related to the national stock in terms of personal protective equipment, I think, and the need to maintain that. There were, subsequently—. The New and Emerging Respiratory Virus Threats Advisory Group had things to say, didn't it, about PPE, at various junctures, at different times running up the pandemic. In your view, were they always followed, at the UK and Welsh level?

Do you mean with the stockpiles of PPE?

Yes, the national stockpiles. There was a Welsh national stockpile, wasn't there, managed by the UK Government, but they were separate, as I understand.

The evidence from our interim operational review is that there were a lot of challenges with those stockpiles, either with the maintenance of them—. And I know the inquiry is going to come on to a whole separate module of PPE, so I don't want to pre-empt that. But from our own interim operational review, there was a lot around how that was managed as well: so, the movement of that stock, the distribution of that stock and which sectors it went to and how, I think, were some of the challenges. So, it's not just about the maintenance of its sell-by date, it's also about the supply of specific ones, which was a challenge as well. So, the procurement lines back through to China, for example, was quite challenging—that's evidenced in our reports—but, yes, also the movement around the country of those stockpiles.

One of the other exercises, Exercise Taliesin—I don't know if you're familiar with that—you two talked about a whole-societal approach. That does actually talk, doesn't it, about school closures and managing that, so, certainly, at that exercise level, there was consideration of interventions that went beyond health. Did that feed also into some of the policy documents as well, in the same way that Cygnus, you say, had influenced?

So, in my view, I think the challenges from that, in my opinion, are that the training exercising and the learning for the training exercising sometimes aren't translated to a wider cadre of people, and so the cinderella point comes up that, if you've got chief constables or if you've got directors of public health, people that change between how that is stored in organisational memory within those structures—I think that became the challenge.

Okay. I think that, at that point—

Sorry, we're going to have to—

—we'll pause.

Sorry. Finally, one more question—we've just gone slightly over time; appreciate your patience—from Joyce Watson.

I think, moving on, the key questions here are: are there specific legislative or policy changes that you might recommend to strengthen the existing frameworks, and also, more widely, are there established mechanisms for learning from international experiences, to share that best practice?

Thank you. I'll try and be as succinct as possible. So, the first question around—. Sorry, could you just remind me of the main premise, just to make sure that I've got it correct?

Whether there were any specific policy changes.

I think, in the Welsh Government review of the civil contingencies, for me, in my opinion, it's around strengthening the standards and who is looking and who is accountable, how do you demonstrate and share that good practice. I think all of the different reviews come back to implementing some form of networks of understanding of standards. And I think we struggled with that, at the moment, in civil contingencies, for quite a while, about how that works, where that sits, who does that, how do we resource it. There is a set of standards, but, ultimately, in an area of horizontal, complicated policy, to give that to a system that—. Let's face it, their main jobs are elsewhere doing other things, and then this system stands up to manage emergencies—. Making sure that that is current, up to date, healthy and is effective—I think that's something that we don't do at the moment that we should be doing.

And sharing international best practice?

I think that's aligned; it's quite siloed. The United Nations Office for Disaster Risk Reduction do a really good job; the United Nations lead a lot of thinking, and they have a series of learning structures and work streams. How we participate in those is up to individuals. There are also a series between all of the different risks—for example, there are networks around counter-terrorism learning, there are networks around health learning—but I think the UNDRR is the place where all of that comes together, in my opinion.

Okay. Thank you very much. And thank you very much for both the presentation and for answering the questions. I'm only sorry we didn't have more time, really, to get into that a bit more, but I think there's a lot there we're going to follow up on as a committee, so I appreciate you being with us today.

A transcript of today's meeting will be published in draft form; it will be sent to you to check for accuracy before the publication of the final version. So, thank you, both, very much for coming in.