Compliance and Review Methodology 2025

Consultation

November 2025


Contents


  1. Introduction 1

  2. Key developments 1

  3. Consultation 2

  4. Appendices 2

Appendix 1 – Summary of key changes 3

Appendix 2 – Consultation questions 10


ii

  1. Introduction

    1. The SSRO’s compliance and review methodology (the methodology) identifies how the SSRO exercises its function, under section 36(2) of the Act, to keep under review the extent to which persons subject to reporting requirements are complying with them. It also identifies how the ongoing review and associated findings link to the SSRO’s wider functions, particularly how its duty under section 39(1) of the Act to keep under review the provision of the regulatory framework established by the Act and the Regulations may be informed by information obtained from compliance monitoring.


    2. The SSRO has been operating its current methodology since October 2024, having last been updated in January 2023. In that time, there has been a substantial growth in component level reporting, and we have received stakeholder feedback about the “correct first time” Key Performance Indicator (KPI).


    3. The SSRO is consulting on proposed changes to its methodology and invites stakeholder views on its proposals, together with supporting evidence where appropriate.


  2. Key developments

    1. Some of the key proposed developments to the methodology to:


      1. Replace the summary of KPIs to match the exact wording in the SSRO corporate plan 2025-26;

      2. Amend subsequent paragraphs that refer to “correct first time” as the KPI to a KPI that is a measure of ‘issues outstanding’;

      3. Note that we may adjust the “issues outstanding” calculation from what is currently live on DefCARS, to refine the analysis in the future. This would include adjustments like:

        1. issues closed without response;

        2. issues that were raised very recently for which it is not reasonable to expect a response; or

        3. issues that may be left open without response.

      4. Add a paragraph to note we will also consider other measures of data quality (including the original correct first-time measure).

      5. Change our review timescales from 15 working days following the MOD review (with up to 15 working days left for the MOD) to just 30 working days.

      6. Note that our review activity is resource dependent, and that we will prioritise initial reports, new contractors, follow-ups, and targeted or thematic reviews.

      7. Make small amendments for legal accuracy or references as set out in the table below.

    2. Where changes are proposed to current methodology, Appendix 1 of this consultation document provides the current methodology wording, proposed methodology wording and rationale behind the reason for the change in tabular form.

      1

  3. Consultation

    1. This consultation document has been published on the SSRO’s website. The consultation deadline for this set of proposals is 09 January 2026.

    2. Consultation questions are included in Appendix 2 of this consultation document to guide feedback, but comments are welcome on any aspects of the proposals. When responding, stakeholders are asked to indicate if they have any objections to the SSRO publishing their consultation response on the SSRO’s website alongside its feedback on the changes which have been made following consultation.

    3. If you would like to discuss any aspects of this consultation, please contact Peter Lomas at peter.lomas@ssro.gov.uk.

    4. Written feedback on the consultation proposals should be sent to consultations@ssro. gov.uk. There is no specified format for response.

    5. We expect to publish the outcome of the consultation at the end of January 2026.


  4. Appendices

    1. The following appendices are attached to this consultation paper:


2

Appendix 1 – Summary of key changes


Current wording

Proposed wording

Reason for change

2.2 It is helpful to have some broad measures of whether reporting requirements are being met that can be monitored over time. There are three key performance indicators that the SSRO will apply when measuring compliance against statutory reporting requirements:

1a) “All required reports have been submitted within the relevant deadlines”;

2a) “Where reviewed, reporting obligations have been met first time for all reports submitted, in accordance with the Regulations and relevant statutory guidance”; and

2b) “Where reviewed, reporting obligations have been met either first time or in subsequent submissions for all reports submitted, in accordance with the Regulations and relevant statutory guidance”.

2.2 It is helpful to have some broad measures of whether reporting requirements are being met that can be monitored over time. There are two key performance indicators that the SSRO will apply when measuring compliance against statutory reporting requirements:

  1. percentage of reports that are submitted on time (target >75%); and,

  2. percentage of reports that remain with reporting issues outstanding one month following the end of the twelve-month reporting period (target <5%).

Aligns description of KPIs with our KPIs in the 2025-2026 Corporate Plan.


Current wording

Proposed wording

Reason for change

2.3 The SSRO has historically assessed the quality of submissions using performance indicators that are based on a ‘pass or fail’ assessment, so a single error in a report will result in a fail assessment, which in the case of a reporting matter impacts the quality rating for that submission. This assessment approach will continue, but in addition the SSRO will develop and publish compliance management information to accompany the quality assessments.

2.5 The SSRO has historically assessed the quality of submissions using performance indicators that are based on a ‘pass or fail’ assessment of whether the submission was correct in its original submission. In keeping under review the extent to which persons subject to reporting requirements are complying with them, the SSRO will also continue to consider wider metrics of data quality. This includes an analysis of ‘correct first time’ submissions, the level of manual review by the MOD or SSRO, and analysis of consistency and completeness of the content of reports.

Expanded to provide a better description of the additional quality metrics the SSRO may consider; specifically noting we may still look at ‘correct first time’ despite it not being a key KPI, but also potential ‘whole population’ measures that may be developed in future.

    1. A reporting obligation will be identified as not being met for the purposes of indicators 2a) and 2b) if the SSRO or the MOD has raised an issue on a submission which has resulted in the contractor:

      • submitting a correction report to rectify an error;

      • providing additional information required by the legislation; or

      • failing to respond to the issue raised.

2.3 A reporting obligation will be identified as not being met for the purpose of indicator 2) if the SSRO or the MOD has raised an issue on a contract or supplier report submission and the contractor has failed to respond to the issue raised. In its analysis, the SSRO will make clear whether it is including issues that were eventually closed after no response

from the contractor or MOD, or any other adjustments made compared to live system data.

Phrasing altered to suit the “issues outstanding” KPI rather than “correct first time” KPI.

Specifically, the issues outstanding KPI is not failed when corrections are made.


Current wording

Proposed wording

Reason for change

N/A

2.4 NEW

We intend to allow for:

  • our timeliness indicator to be based on supplier report submissions and contract level submissions but to also include component completion report submissions;

  • our quality KPI calculations will be based on contract level data in contract reports and supplier report submissions, including the new component completion report submissions but excluding any other component level information included in contract reports. As familiarity grows with the updated reporting requirements, the KPI calculation may be adjusted to take into account component level information in the future; and

  • in any one year, where the SSRO undertakes additional Targeted or Thematic reviews, these would not count towards the KPI unless any specific issue in relation to a report submission is raised within DefCARS.

The calculation will take into account all issues raised on contract and supplier reports, but not the component level submissions (apart from the Component completion reports which is specifically identified in the legislation as a new type of report from 1 April 2024).


Current wording

Proposed wording

Reason for change

3.4 The SSRO aims to commence manual reviews of contract reports when 15 working days have elapsed from submission of the report (to allow time for the MOD to carry out its own reviews, as set out in section

5), and to complete the reviews within a further 15 working days. The SSRO does not currently apply review timescales to correction reports or to supplier reports, but may do so in the future. The SSRO will aim to complete its own review within the initial

15 working days from submission if it is clear that there are no issues to be raised on a report.

3.4 The SSRO aims to complete manual reviews of contract reports when 30 working days have elapsed from

submission of the report. The SSRO does not currently apply review timescales to correction, component or supplier reports. Only contract reports are reviewed on a routine basis.

Change to give more flexibility in when issues can be raised by the SSRO. In many cases there are no MOD reviews, which only results in a delay in contractors receiving feedback.

Also is explicit in stating that only contract reports are reviewed routinely.

N/A

NEW 3.5 The SSRO’s manual review activity is resource dependent. In general, the SSRO will prioritise initial reports, new contractors, following up on prior issues, targeted and thematic reviews as set out in Section 4, or selecting reports on a sample basis.

Provides industry and the MOD a list of how the SSRO prioritises its compliance review activity


Current wording

Proposed wording

Reason for change

3.7 In some instances, the SSRO’s review of a submitted report will raise an issue as to whether the pricing requirements of the regulatory framework have been met. For example, the reported calculation of the contract profit rate may appear not to follow the six steps required by section 17 of the Act and regulation 11. In such cases, an issue may be raised by the SSRO to inform

its understanding of how the provision of the Act and the Regulations is operating, in line with its duty under section 39(1) of the Act to keep under review the provision of Part 2 of the Act and the Regulations.

3.8 In some instances, the SSRO’s review of a submitted report will raise an issue as to whether the pricing requirements of the regulatory framework have been met. For example, the reported calculation of the contract profit rate may appear not to follow the four steps (previously six) required by section 17 of the Act and regulation 11. In such cases, an issue may be raised by the SSRO to inform its understanding of how the provision of the Act and the Regulations is being applied, in line with its duty under section 39(1) of the Act to keep under review the provision of Part 2 of the Act and the Regulations.

Update for profit rate steps and grammatical changes.

3.10 Section 2 sets out key performance indicators 2a) and 2b) and that, for the purposes of applying the indicators, the SSRO will rely on the contractor’s response rather than forming its own conclusion about compliance. Any issues categorised as pricing issues will not impact these indicators, nor will the SSRO form any concluded views about those matters.

3.11 Section 2 sets out key performance indicators and that, for the purposes of applying the indicators, the SSRO will

rely on the contractor’s response rather than forming its own conclusion about compliance. Any issues categorised

as pricing issues will not impact these indicators, nor will the SSRO form any concluded views about those matters.

Earlier paragraph reference change.


Current wording

Proposed wording

Reason for change

3.11 We will count the submission as a ‘pass or fail’ of an entire submission once made, regardless of the number of

errors that may be apparent in the initial submission, but will also make clear the quantum of issues arising per report submission. In addition the SSRO will develop and provide regular management information to contractors who make the greatest number of contract or supplier report submissions to allow them to understand the range and quantum of issues identified within submissions. Similar information will be available for other contractors upon request. We will report these indicators as a twelve-month average as a proportion of report submissions in any compliance report.

3.12 The SSRO will develop and provide regular management information to contractors who make the greatest number of contract or supplier report submissions to allow them to understand the range

and quantum of issues identified within submissions. Similar information will be available for other contractors upon request. We will report these indicators as a twelve-month average as a proportion of report submissions in any compliance report.

Removed the first sentence as this is covered by the initial part 2 paragraphs which include that the SSRO will consider various additional measures of data quality.

5.3 The SSRO will seek to avoid duplication between the MOD’s reviews and its own compliance reviews, with the aim of avoiding any unnecessary burden on

industry. After a report has been submitted, which involves automatic validation checking in DefCARS, the SSRO will

allow time for the MOD to review a report submission before it undertakes its own review. The period of time allowed is 15 working days from the date of submission, in line with the MOD’s own internal target for reviews.

5.3 The SSRO will seek to avoid duplication between the MOD’s reviews and its own compliance reviews, with the aim of avoiding any unnecessary burden on industry.

Removed later part of the original as part of change to give additional flexibility around the time period within which the SSRO can be reviewing, identifying and raising reporting issues.


Current wording

Proposed wording

Reason for change

8.2 The SSRO will regularly summarise the findings from its compliance work in a Compliance Report, which will consider the performance indicators on timeliness and quality of report submissions. In any one year, the report may be supplemented with further analysis, including summaries of our targeted and thematic reviews, a factual commentary on the data, emerging themes and areas where changes or improvements are required and recommendations for action, as appropriate.

8.2 The SSRO will regularly summarise the findings from its compliance work in a Compliance Bulletin, which will consider the performance indicators on timeliness and quality of report submissions. In any one year, the report may be supplemented with further analysis, including summaries of our targeted and thematic reviews, a factual commentary on the data, emerging themes and areas where changes or improvements are required and recommendations for action, as appropriate.

Document reference name change.

Appendix 2 – Consultation questions

  1. Do you have any concerns with aligning the compliance methodology to the wording in the SSRO’s corporate plan 2025-26?


  2. Do you agree with how the SSRO intends to prioritise report reviews?


  3. Do you agree with the SSRO releasing any issues as-and-when they are noted, rather than waiting for possible MOD feedback?


  4. Are there any other points regarding the compliance methodology you wish to raise?