Executive summary

Since the introduction of componentisation in April 2024, the SSRO has received a notification of a component existing on 64 contracts. As of 2 June 2025, almost three in four contracts that we identified as likely to have a component have not had a component report submitted despite relevant due dates passing. This is likely to be an underestimate as the SSRO is not able to identify all components. The SSRO, MOD and industry continue to engage via the Reporting and IT Sub-Group to jointly address these issues.

Introduction

Since 1 April 2024, the Defence Reform Act 2014 (DRA) has provided a definition of a component of the contract price[6]. A part of a contract is to be treated distinctly where either the Single Source Contract Regulations (the Regulations contain provision to that effect (i.e. the effect of applying the Regulations is that part of the contract is treated distinctly in determining the price payable), or where the parties agree that it should. Examples of a component are where a contract:

• • uses a different contract pricing method to the contract pricing method used in any other part of the contract;

• • has a different contract profit rate to the contract profit rate used in any other part of the contract; or

• • has a price which has been re-determined in accordance with a provision of the Schedule that requires the part to be treated as a new component.

The Regulations make provision for the reporting of component information throughout the duration of the contract and set different reporting requirements depending on when the contract was entered into, when amendments are made to those contracts and what the value of those pricing amendments are. The reporting requirements are based on different contractual circumstances, including if the:

• • contract became a QDC before 1 April 2024 and has component(s) valued less than £50m;

• • contract became a QDC before 1 April 2024 and has component(s) valued greater than £50m;

• • contract became a QDC on or after 1 April 2024 with component(s) (whatever the value) from the outset;

• • contract became a QDC on or after 1 April 2024 and with component(s) valued less than £10m is added by amendment later; or

• • contract became a QDC on or after 1 April 2024 and with component(s) valued greater than £10m is added by amendment later.

This thematic review covers all contracts that became a QDC/QSC before 31 March 2025. For those contracts in effect following the change in legislation on 1 April 2024, we consider:

• • the number of contracts that may have components based on available information from DefCARS, and the total number of components on each of these contracts;

• • what the Regulations would have required to be submitted by now for each contract, and how many of these contracts have established components in DefCARS for which a report submission has come due; and

• • what common reporting issues we have observed with component level information in submissions that have been made so far.

Methodology

In the first instance we can identify components where we have been informed about them by the contractor, and the SSRO establishes these components in DefCARS. Where we have not been alerted to any components, we can use reported data on contract pricing types or commentary on the contract profit rate. The former can be identified easily through data extracts from DefCARS, while the latter requires manual review.

Identifying components from multiple contract pricing types

For components based on a different contract pricing method, the Regulations require the contractor to report a breakdown of the total contract price by pricing method in each of the report submissions and the SSRO can use this to identify components based on pricing type. In some cases, the reported price breakdown may indicate a component is greater than £50 million, and may therefore require component QCRs.

Identifying components from multiple contract profit rates

The SSRO has manually reviewed attachments and comments on contract reports to identify potential components based on profit rates. We relied on keyword or other indicators[7] to identify possible profit components, which resulted in over 200 contracts to review (or over 40 per cent of contracts active within the review period).

Assessing the overall number of components

Where possible, the SSRO has identified if the profit-rate component is distinct from a pricing type component to avoid double counting the total number of components in a contract. In many cases it is not possible to be certain of the components of a contract because contractors have provided a comment or attachment that the profit rate is blended, but we have no further information to show how rates have been blended. In these cases, we have made an assumption that the pricing type and profit rate components overlap.

For example, if a contract has both cost-plus and firm pricing types, and a comment indicates the contract profit rate is a blended calculation of two numbers, we have assessed two components rather than four (i.e. we assume the two profit rates align to the two pricing types, which may or may not be the case). These would be counted as two pricing method components and zero additional “distinct” profit rate components. If, however, we observed six profit rates and two pricing methods, we have assessed these as a total of six components: two pricing methods and four additional distinct profit rate components.

This methodology is fully reliant on DefCARS data to produce an estimate of the number of components. When identifying different pricing types, the data is relatively clear, but for different profit rates we must rely on interpretation of comments or attachments. Furthermore, some contractors have told us there may be hundreds of components not separately identified based on their agreement of multiple tasking authorisation forms (‘TAFs’) with different profit rates; in this case, the following values would be materially underestimated.

In some cases, we may not have identified a component using either of these methods, but we will have been notified of a component by the contractor on DefCARS. In 15 cases, we did not identify any components on the contract before being notified (resulting in 44 additional components), and in other cases we identified some components but were notified of additional ones by the contractor (resulting in 192 additional components).

Analysis

As of 2 June 2025, 511 contracts were included in the review window. Of these, 210 contracts have 884 potential components based on available information, set out in the table below.

Table 1: Count of contracts likely to have components and number of components

Figure 1 highlights that a contract can have components based on pricing types and profit rates and will commonly have both.

Figure 1: Contracts and components by whether they were identified as having multiple pricing types, profit rates, or both

Components based on different pricing methods

The table below breaks down the contracts with multiple pricing methods. The most common type of component is having a contract with both a firm and a fixed pricing method, followed by a contract with both a firm and cost-plus pricing method.

Table 2: Count of contracts where there are multiple pricing methods

Components based on different profit rates

Our estimate of distinct profit-rate components is only approximate because we rely on interpreting comments or attachments in DefCARS. This is likely to be a substantial under-estimate, as contractors have told us there are potentially hundreds of profit-based components on some contracts.

We were able to identify at least 98 contracts that, when taken all together, contained a total of 361 profit rates. A common cause for blending profit rates is contracts with multiple tasking orders, or TAFs, each of which may have a different profit rate. In some cases, we observed these profit rates to only be a few basis points different from each other.

Of these 361 components, some may align to existing pricing method components.  Where we did not have information suggesting otherwise, we assumed pricing method components aligned with the different profit rates, for this reason, we have only counted 318 additional “distinct” components.

Table 3: Count of contracts and components by number of profit rates on the contract

*Distinct from components based on contract pricing method, as explained in para 1.9.

Compliance and components on DefCARS

Table 4 shows there have been 393 components set up on DefCARS since 1 April 2024, across 64 contracts. Of these, we would not have been able to identify 236 through the analysis methodology detailed above, demonstrating that components are difficult to identify based solely on existing information contained in DefCARS.

Table 4: Summary of component information on DefCARS as of 2 June 2025

Of the 210 contracts that we identified as having in total 884 probable components, in some cases the contractor would not yet need to submit a report. This is because the reporting depends on the circumstances of each contract to determine when such reports are due.

We encouraged contractors to submit an on-demand contract reporting plan for components as soon as was possible. This was to help contractors prepare for future submissions; however, submitting this plan is not a requirement under the Regulations in most cases. Of the 393 components set up on DefCARS, there have been 108 on-demand reporting plans submitted. The due date of the first component report required under the Regulations for the 210 contracts is set out in Table 5.

Table 5: When the first component report on a contract would be required

Notes: ICR dates for components could be changed by agreement with the MOD. Component size only assessed for contract pricing methods.

Using these scenarios, we can identify for which contracts in each group there ought to have been a first component report submitted, as of 2 June 2025. We can compare this to how many of these contracts have components set up for them on DefCARS and for which a submission has been made.

We have not assessed whether a particular report was on time or not, only whether a report has now been made. Of 210 contracts, a submission has not yet been required for 69 of them. The first report due date for a component has passed in respect of 141 contracts. Of these 141 contracts, a report has been submitted for 32. In respect of 15 of the 141 contracts, although components have been created on DefCARS for them, no report has yet been submitted. No action has yet been taken in respect of 94 of the 141 contracts.

Table 6: Number of contracts with components on DefCARS and reports

Overall submission coverage

Table 7 shows that about three in four contracts or components have yet to have any report made, despite passing a relevant due date.

Table 7: Comparing identified components vs submitted reports

Table 7 includes reporting plan submissions. The table sets out whether a contractor has made steps to establish components on DefCARS, not whether they have fully complied with the Regulations. If compliance was assessed on a component-by-component basis, the rate of compliance would be lower. Additionally, the contractor needs to be aware of the circumstances of their contract to identify the necessary reports. For example, a contractor may mistakenly submit a CIR rather than an ICR as required. The expected type of component report may have been submitted for as few as 13 contracts (approximately 1/10 contracts).

In most cases, only one report would need to have been submitted for a component to date. The transitional provisions to the Regulations mean that QCR submissions for contracts entered into before 1 April 2024 only become due from 31 July 2025. It is only for contracts valued above £50 million that were entered into after 1 April 2024 where additional QCR reports for components would have become due before 2 June 2025. To date, we can identify six contracts entered into after 1 April 2024 with at least one pricing-method component greater than £50 million. In total, there are five QCRs we would have expected in addition to a CIR across these six contracts. None of these six contracts have submitted any component level report information.

Analysis of issues arising

We noted in the recent consultation response to our compliance methodology a number of changes. Specifically, our KPI calculations would be “excluding any other component level information included in contract reports. As familiarity grows with the updated reporting requirements, the KPI calculation will be adjusted to take into account component level information in the future.”

For this thematic review we reviewed 53 component level submissions. In doing so, we identified a total of 56 issues with the submissions, summarised as:

• • completion of component level information when not required (17 cases);

• • information relating to specific components not provided (18 cases);

• • merging of information across multiple components (11 cases);

• • transitional provisions relating to QCR reporting and reporting of recovery bases not followed (9 cases); and

• • completion of SSRO funding adjustment when the step is no longer applicable (1 case).

We observe the challenges of having component reports set up as separate contracts within DefCARS; specifically, the lack of validations across a set of components and the parent contract. As part of our future data quality work, we intend to examine consistency between component and parent contracts reports and undertake a thematic review on issues arising across all component level submissions.

Executive summary

The declining proportion of contract reports reviews by the MOD, versus relatively high level of MOD supplier report review impact the SSRO’s headline quality KPI: ‘correct first time’ reports. For this reason, the SSRO is developing an “issues outstanding” metric as one of its future KPIs to focus on contractors responding to raised queries rather than on the initial submission as a measure of overall quality. We can also make our KPI more robust to review procedural challenges such as ensuring all issues are closed or consistency in reviewer approach.

Introduction

As per the SSRO’s Compliance and review methodology October 2024 (“the methodology”), we have developed DefCARS to facilitate the review by both the MOD and the SSRO of report submissions. DefCARS allows issues to be identified and responded to within the system. Without access to the contracts, the SSRO bases its reviews on automatic validation warnings;[8] only the MOD can confirm whether submissions accurately reflect the qualifying contract.

Under section 2 of the methodology, we set out the use of a ‘pass or fail’ approach to assessing the quality of submitted data. If there is a single unresolved issue on a report, the report is categorised as “issues outstanding”.  Where there are no active issues, reports are categorised as “correct first time” or “correct on subsequent submission”, depending on whether: any issues were raised in the first place, if the issue was set to have an impact on the quality indicator, and if it was a reporting issue rather than a pricing issue[9].

MOD’s review would be able to cover more content of a report, as the MOD has access to further information about the contract. In addition, DefCARS can indicate that a report has been reviewed and marked (by the MOD and/or SSRO) as “no current issues”. Where a report has been marked as “no current issues” or an issue raised, our statistics consider this report to be formally “reviewed” by that party, which is distinct from having ‘accessed’ the report on DefCARS with no evidence of formal review.

Our thematic review in relation to reporting issues and the quality indicator examines how the MOD uses DefCARS facilities for raising issues; specifically:

• • how many reports can be counted as ‘formally reviewed’ by the MOD on the system;

• • how many issues the MOD raises and the coverage of issues across contracts reports and supplier reports;

• • the amount of time that passes between an original submission and raising of subsequent issues; and

• • how many issues raised by the MOD are left open despite subsequent submissions being made.

Review of reports

Coverage of MOD reviews on contract reports

DefCARS provides the functionality to record when a review of a submission has been made. This also allows the SSRO to analyse whether report submissions have been reviewed by either the SSRO or the MOD.

Our analysis for this thematic review considered a total of 755 contracts with reports due between May 2018 and 30 April 2025 (the review period). Of these, at least one report was submitted per contract for 694 contracts. Of these 694 contracts, 328 (47 per cent) contracts have not had a MOD review of any of the reports submitted to DefCARS, i.e. for 328 contracts, no report associated with that contract has had an issue raised or had a MOD user set the report to “no current issues”.

Available data shows that just less than half of these 328 contracts had at least one report accessed by a MOD user assigned to verifying contract data; as a result, while it may not count as reviewed, the data within the report was still accessed. However, this does not assess whether contract information is routinely accessed.

Figure 1 shows that the most common outcome is to have less than 10 per cent of reports submitted in respect of a contract reviewed by the MOD in DefCARS. 340 contracts have had between 0 per cent and 10 per cent of their reports reviewed. However, the second most common occurrence is that contracts have had more than 90 per cent of their reports reviewed, whereby 110 contracts have had more than 90 per cent of their reports reviewed by the MOD.

Figure 1: Number of contracts grouped by what percentage of reports have been reviewed by the MOD for that contract, all reports submitted since May 2018.

Table 1 shows that the percentage of contracts which have had none of their reports (from that year) reviewed by the MOD has also been increasing year-on-year for the last seven years.

Table 1: Number of contracts by financial year with no associated report reviews by the MOD

Coverage of MOD reviews on supplier reports

Reviews of supplier reports by the MOD have significantly increased since 2022/23.

A similar calculation can be done for Qualifying Business Units (QBUs), counting in each financial year how many QBUs were set up on DefCARS that submitted at least one report, then how many of those have not received any MOD review on any report.

Table 2 shows that in 2024/25, 76 QBUs submitted a report on DefCARS. 30 of those did not have any of their reports from that year reviewed, but the MOD tends to review supplier report submissions in bulk and there will likely be further reviews after the cut-off date for this report of 2 June 2025.

Table 2: Number of QBUs by financial year with no associated report reviews by the MOD

The total number of report submissions (rather than contracts or QBUs) for 2024/25 by their MOD review status is shown in Table 3.

Table 3: Total report submissions for reports relating to 2024/25 by whether they have been MOD reviewed

MOD access history

One possibility is that the MOD may examine and use DefCARS data, but not indicate it as “reviewed” on the system. We have therefore examined the last date a MOD “verifier” (a user role with permissions for verifying reported data, typically a commercial officer) accessed any page relating to a contract. We found that 209 contracts have never had a MOD verifier access any page.

Of 426 contracts for which a report has been submitted for the 2024/25 year, 179 (42 per cent) have not had a MOD verifier access it during the year.

Duration of time to raise issues

The median number of days from an original contract report submission and an issue being released to the contractor is approximately the same for both the MOD and the SSRO: about 20 calendar days.

The SSRO aims to review reports within 15 working days following the MOD review. Where the MOD does not review reports, the SSRO typically reviews reports only after 15 working days from the date of submission. This impact is visible in the duration curve below, showing a substantial jump in the issues released by the SSRO at approximately the 20 calendar day point (approximately 15 working days). This is because the SSRO holds issues in draft to allow the MOD to release issues before the SSRO.

Figure 2 shows about 20 per cent of MOD issues on contract reports, and 1 per cent of SSRO issues are released more than 45 days following the original report submission.

Figure 2: Percentage of issues released by number of calendar days since the report was submitted, on contract reports submitted between 1 January 2023 and 30 April 2025, excluding correction reports.

For supplier reports, the SSRO does not release issues until the MOD has reviewed the report. As the MOD is now undertaking more reviews of the supplier reports, the SSRO is phasing out its reviews and may only look to review upon request in the future. For these reasons, SSRO issues on supplier reports may be released much later than issues on contract reports.

Overall, since 2023, the median time to release an issue is 16 calendar days for the MOD, and 20 calendar days for the SSRO as shown in Figure 3.

Figure 3: Percentage of issues released by number of calendar days since the report was submitted, on supplier reports submitted between 1 January 2023 and 30 April 2025, excluding correction reports.

Analysis of issues

When issues are resolved within DefCARS, the SSRO or MOD can select whether the issue impacts the compliance rating, which would be the case if additional information is required.  The user can also categorise the issue as one related to reporting (impacts compliance), and pricing (does not impact compliance). As shown in the following table, nearly a quarter of issues raised are set to have no compliance impact by one of these methods.

Number of issues by type and compliance impact, since May 2018

* Note, a single issue could affect multiple reports under the Regulations but are shown as only one issue for this table. **Pricing issues can technically be categorized as impacting compliance within DefCARS, but all pricing issues are excluded from quality statistics and are therefore included in “no compliance impact” here.

Our core compliance bulletins contain statistics on what pages and data fields issues related to most commonly.

Other concerns relating to raising issues and the impact on a measure of quality

DefCARS facilitates the MOD reviewing reports, and where issues are raised by the MOD a report is categorised as “issues outstanding” until the issues are closed by the MOD on the system itself.

We received feedback from contractors that the MOD managed some issues in a manner that unfairly impacted the quality statistics, for example:

• • issues being left open by the MOD despite being actioned by the contractor;

• • issues raised against relatively trivial matters like blank fields vs entering zero, or hardcoding values rather than leaving a formula; or

• • issues raised by the SSRO that receive no response from the MOD.

We examined these examples and present our findings in the following table:

Reporting issues which impact quality, since May 2018

Note these reports may have had other issues impacting the quality of the submission, in which case the correction of these issues would have no impact on the overall measure of quality.

In addition, these issues cover reports over 7 years. In the SSRO’s analysis, these will not make a material impact on headline measures of quality (between 1-5 per cent of reports might change quality status).

Correct first time quality indicator

There are three main criticisms of the current ‘correct first time’ KPI for submissions:

• • it can be negatively impacted by increased MOD reviews, which are arguably increasing overall data quality;

• • the indicator does not change based on how engaged or prompt a contractor is in resolving issues; and

• • there is no assessment of issue materiality

Ideally, our headline quality indicator should track the overall quality of the entire DefCARS dataset, and any action that ultimately improves this data quality should improve our indicators. While we still consider that “correct first time” is a useful measure, particularly for established contracts which have a history of regular review, we want to use a method better suited to compare reporting organisations for our core KPI.

For this reason, we are proposing to move to an “issues outstanding” metric, which will focus on contractors responding to and resolving issues with reporting. However, this metric requires development (or snapshots) to compare over time, because issues are steadily closed. As a result, there will always be more issues outstanding on recent reports than historical reports.

Issues closed by the SSRO due to lack of response

As set out in paragraph 6.8 of the compliance methodology, the SSRO closes any outstanding issues on DefCARS six months after the report due date if the SSRO receives no response but sets it as having an impact on quality. If there are no other issues on the system, this changes the status of the report from “issues outstanding” to “correct on subsequent submission”.

To the extent that these issues were genuine and remain unresolved, closing the issue does not reflect an increase in data quality; it is just that the issue is unlikely to be actioned after that date. We have examined historical issues to build a better metric of issues outstanding “as of” a historical date.

Specifically, we:

• • counted issues that were active as of 1 June each year, for the previous reporting year (reports due between 1 May and 30 April);

• • treated issues as closed if a correction report had been submitted and was awaiting a response, even if the issue had not yet been officially closed;

• • ensured issues counted only if there was at least 15 calendar days of time to respond; and

• • treated the issue as still active if the SSRO closed it only due to no response.

In our analysis, over the last 7 years, around 4-6 per cent of reports for the previous financial year had issues outstanding, as of one month following.

We will continue to develop this metric with our stakeholders ahead of the 2025/26 annual report, as well as additional measures of quality that better summarise quality of the whole dataset.

SSRO functions

The SSRO must keep under review the extent to which persons subject to reporting requirements under Part 2 of the Act are complying with them.

The SSRO’s compliance methodology directly supports two of our statutory functions:

• • the requirement under section 36(2) of the Act to keep under review the extent to which persons subject to reporting requirements are complying with them; and

• • the requirement under section 39(1) of the Act to keep under review the provision made by Part 2 of the Act and the Regulations.

In carrying out these functions, the SSRO must aim to ensure that:

• • good value for money is obtained in government expenditure on qualifying defence contracts (value for money); and

• • that persons who are parties to qualifying defence contracts are paid a fair and reasonable price under those contracts (fair pricing).

Submission requirements

Defence contractors are required to submit two types of reports (contract and supplier), as summarised in Figure 1.

Figure 1: reports required under the regulatory framework

Our analysis refers to three types of contract reports, being the initial, update and completion reports:

• • ‘initial reports’ being the Contract Pricing Statement (CPS), the Contract Reporting Plan (CRP) and the Contract Notification Report (CNR), known collectively as the Contract Initiation Report (CIR);

• • the ‘update reports’ being the Interim Contract Report (ICR), the Quarterly Contract Report (QCR), and any on-demand report CPS, CRP and ICR; and

• • the ‘completion reports’ being the Contract Completion Report (CCR) or Component Completion Report (CompCR), Contract Costs Statement (CCS) and any on-demand CCS.

We also refer to two types of supplier report:

• • ‘overheads reports’ being the Qualifying Business Unit Estimated Cost Analysis Report (QBUECAR), the Qualifying Business Unit Actual Cost Analysis Report (QBUACAR), the Estimated Rates Agreement Pricing Statement (ERAPS), the Estimated Rates Claim Report (ERCR), the Actual Rates Claim Report (ARCR) and the Rates Comparison Report (RCR) which is only triggered by a written notice from the Secretary of State; and

• • ‘strategic reports’ being the Strategic Industry Capacity Report (SICR), and the Small or Medium Enterprises (SME) Report.

The QBUECAR and QBUACAR may together be described as the Qualifying Business Unit Cost Analysis Report (QBUCAR). This QBUCAR is made up of a number of different elements but the area where most data entry is required relates to the analysis of costs, captured by last year prior estimate; last year actuals; last year variance; this year estimate; and this year changes.

Overheads reports may be required for a Qualifying Business Unit (QBU) in some years and not others, depending on whether the ongoing contract condition[10]and QBU threshold[11]are met. The SSRO does not have independent access to the information required to assess whether these requirements are met for a QBU and is dependent on notifications from the MOD and the contractor. The analysis is therefore subject to some assumptions made by the SSRO about submissions that are expected when it is aware of certain conditions having been met.

The reporting requirements are set out in Parts 5 and 6 of the Regulations. The SSRO supplements those requirements with reporting guidance, which contractors must have regard to when completing the reports.

Information included in this bulletin

The SSRO has developed DefCARS, with input from the defence industry and MOD users, to provide an easy to use and secure means of submitting statutory reports. The majority of the analysis presented in this bulletin is drawn from the data submitted into DefCARS. Compliance-related data was only available in DefCARS for reports submitted from 1 May 2018.

The contract data in this bulletin is sourced from the latest of the CPS, CNR, QCR, ICR, CCR or CCS. Data related to quality and timeliness of submissions are sourced from DefCARS. This bulletin analyses reports submitted on or before the cut-off date of 02 June 2025. It considers:

• • QDCs and QSCs entered into between 1 April 2015 and 31 March 2025 and notified to the SSRO by 30 April 2025;

• • associated contract and supplier reports that were due for submission between 1 May 2018 and 30 April 2025; and

• • all report submissions received and reviewed for compliance issues up to 02 June 2025 to provide the SSRO and MOD time to review and resolve issues within these reports.

Reporting on compliance issues

The SSRO reviews the reports submitted by contractors and seeks to understand the information provided, relying on automated validation checking in its DefCARS system. More detailed, manual investigations around validation warnings that have not been addressed by the contractor are also considered. The SSRO focuses its manual reviews on issues that can be linked to validation warnings and may base targeted or thematic reviews on issues identified from validation warnings.

Ensuring the accuracy of reported information depends on the MOD also checking reported information and taking action where appropriate. We have enabled the MOD to raise queries with contractors in DefCARS and for contractors to respond in the system, and this information is reviewed by the SSRO as part of the application of its compliance methodology.

The SSRO’s review process starts after a contract submission has been made and depending on the timeliness of contractor responses to issues, can continue over a period of several months. The SSRO queries potential errors within report submissions that impact data quality, such as:

• • internal inconsistencies;

• • arithmetical errors; and

• • matters that appear to be erroneous, for example incomplete information.

To keep the provisions of the framework under review, the SSRO may also raise issues with contractors in order to understand relevant explanations relating to the pricing of contracts. In line with the Act and Regulations, contractors are obliged to report the facts, assumptions, and calculations relevant to each element of the Allowable Costs and to describe the calculation used to determine the contract profit rate, including all adjustments to the Baseline Profit Rate.

The compliance approach includes querying obvious errors (for example internal reporting inconsistencies) as well as raising any issues if completed reports seem to be erroneous (for example reports containing incomplete or limited information).

We consider the extent to which persons subject to reporting requirements have complied with their obligations and what this tells us about how the regime is operating. To deliver our statutory aims and functions, we seek to achieve the following:

• • receipt of good quality data from contractors that is relevant, comparable and reliable;

• • identification of issues related to meeting reporting requirements (reporting issues), to data quality and to the application of the regulatory framework, for example pricing control;

• • a shared understanding with the MOD and contractors about identified issues; and

• • appropriate action by the SSRO, the MOD and contractors to address issues. Action by the SSRO to address issues may include revised support to contractors, updated guidance, development of DefCARS and recommendations for legislative change.

Additionally, we have reviewed the reports submitted by contractors to understand the operation of the provisions of the Act and Regulations with respect to the pricing of contracts. While we have sought to understand the operation of the pricing provisions of the regulatory framework by reference to information reported on individual contracts, we have not audited reported costs or profit rates on a contract-by-contract basis, nor provided any assurances that individual contracts have been priced in accordance with statutory requirements.

As part of the compliance and review methodology, the SSRO typically raises queries arising from report submissions directly with contractors. If the contractor does not respond to issues or provides a response that does not address the issues raised, the SSRO passes these matters to the MOD. Issues raised with the MOD may involve both compliance with reporting requirements and the way in which the system of pricing contracts is being applied.

Our assessment of the quality KPI is currently based on a ‘pass or fail’ assessment, so a single error in a report will result in a failure. In line with our compliance methodology we consider a report to be ‘reviewed’ if issues are raised for the contractor to respond to, or if the report is set to ‘no issues’. Both these actions use the compliance functionality built into DefCARS. MOD and SSRO reviews are undertaken independently. This allows us to provide data based upon whether report submissions were correct first time or following subsequent submissions through the submission of correction reports.

Where the SSRO raised concerns with the MOD on pricing issues, particularly as to how the price control provisions of the Act and the Regulations were being applied, these concerns were categorised as:

• • the facts, assumptions and calculations relevant to an element of the Allowable Costs suggested a breach of the Act and the Regulations or deviation from the statutory guidance which was neither reported nor explained;

• • the calculation made under Regulation 11, including any adjustment under the four steps, to determine the contract price of a QDC appeared to be a breach of the Act, the Regulations or a deviation from the statutory guidance but was neither reported nor explained;

• • an unsatisfactory explanation was provided for an apparent contravention of the Act or the Regulations; or

• • a deviation from the statutory guidance was reported by a contractor; and other information material to the pricing of the contract was reported and this appeared to suggest a failure to comply with the Act, the Regulations or a deviation from the statutory guidance.

Data revisions

Compliance data is generally not expected to be static as data may also be revised for previous periods. For example, reports that were not received by the cut-off date can be submitted later, suppliers can provide corrected or updated reports with new data, or the SSRO can be made aware of different reporting requirements that applied.

Where errors are found in the analysis, or where there are significant changes to published data that might affect the utility of the analysis, the SSRO may correct these by reissuing the publication. Where this happens, the reason and impact of the revision will be given.

Adjustments to data

All data is as reported to the SSRO. Some adjustments have been made in circumstances where there are known, and significant, data quality issues so that the analysis is not misleading. Adjustments were made in a small number of cases, for example where some on-demand report requests have been made without an updated CRP.

Additionally, we have manually added to the analysis where the contractor submitted a report outside of the DefCARS system. Mostly, this was for Strategic Industrial Capacity Reports (SICRs), which cannot be submitted in DefCARS.

Analysis

All analysis defines the financial years as being 1 May to 30 April each year. Contractors have one month after the contract becomes a qualifying contract to submit their reports. For example, a contract entered into on 30 March 2025 will have an initial report due date of 30 April 2025 and therefore the initial report would be included in the analysis for the 2024/25 financial year. The analysis aims to be consistent with the Annual Qualifying Defence Contract Statistics 2024/25, which reports on contracts by the government financial year in which they became QDCs/QSCs.

Totals and sub-totals are calculated on unrounded figures, before being rounded for presentational purposes.

Timeliness

Analysis of the timeliness of report submissions uses the report due date to group the analysis by financial year. This date is according to the contractor’s own reporting plans and report submissions, unless they have not yet been received. In some cases, adjustments may be made to these dates to correct for known errors. Report submissions received with blank report due dates will not be included in the analysis as DefCARS cannot determine which financial year the report relates to. Where reporting plans have not yet been received, the SSRO estimates the report due dates where possible, using information available when the contracts are notified to the SSRO.

Quality

Analysis of the quality of report submissions also uses the report due date to group the analysis into the relevant financial year. Prior to 2021/22 the report submission date was used to group reports into the relevant financial year. Historic figures may therefore have changed to allow for a consistent time series.

Issues raised on a report by the MOD or the SSRO only affect the quality indicator if they relate to reporting requirements; those relating to pricing matters are excluded from the analysis. When an issue is raised, there is the ability to mark it as not affecting the compliance rating, for various reasons. Where this has occurred, the issue is excluded from the analysis and does not count as an issue raised for compliance purposes.

If an issue is subsequently closed due to it being resolved (usually due to a correction being made, or additional information being provided), then the report would be counted as being correct on subsequent submissions.

Issues raised where the due date is blank are not included in the analysis as we cannot determine the financial year the issue is attributable to.

If an issue arises on a CIR submission and it is applicable to each of the three initial submissions (the CPS, CNR and CRP), it would be counted as three individual issues raised. If it is not applicable to all three initial reports, a mapping exercise would be undertaken to identify which of the initial three reports the issue relates to. Due to the large number of issues raised, this would not be done on a case-by-case basis and would instead be mapped using the broad information category the issue has been assigned to. If an issue is raised that relates to a field only required in the CPS, for example, this would only count as one issue, and only one of the three initial reports would be assessed as not meeting the statutory requirements. A similar process is undertaken for QBUCARs, where an issue could be raised on data relating to either the QBUECAR or the QBUACAR.

The overall quality indicator reported in the compliance report considers the proportion of reports where no issues have been raised, for all reports reviewed by the SSRO and the MOD. However, due to the low proportion of MOD reviews seen to date, the rest of the analysis on report quality looks at any reports that have been reviewed by either the SSRO or the MOD, to increase the number of reports available for more in-depth analysis. Some figures have also been reported for reviews undertaken by only the SSRO, and only the MOD separately, for information.

When a contractor or, if the issues have been forwarded to the MOD, the MOD, does not respond to an issue raised by the SSRO within 6 months from the date the report was due, the issue is automatically closed by the SSRO. Reports in which issues have not been addressed, but closed after six months, have not been counted as being correct in submissions once the issues have been closed.

Reports accessed

The proportion of reports accessed by the MOD measures if any MOD user has opened a report in DefCARS, regardless of length of time or actions completed whilst in the report. It includes all contract reports, and all supplier reports apart from the SICRs. Reports and their corrections are grouped together, so if a user accesses one of the reports, then the report group is counted as accessed.

The figure for 2024/25 includes all reports submitted (regardless of their due date) between May 2024 and April 2025, and an additional 15 working days has been provided after 30 April to allow users time to access the reports before the measurement was taken.

Actual Rates Claim Report (ARCR): A supplier report required under regulation 34 of the Single Source Contract Regulations 2014

Allowable Costs: A term used for the costs incurred to deliver a QDC or QSC. Costs must be appropriate, attributable to the contract and reasonable in the circumstances to be considered Allowable.

Baseline Profit Rate (BPR): Section 17(2) of the Defence Reform Act 2014 and regulation 11 of the Single Source Contract Regulations 2014 require that the contract profit rate for any qualifying defence contract must be calculated by applying four steps. The first step requires taking the Baseline Profit Rate which has been determined by the Secretary of State.

Component: Section 15(6) of the Defence Reform Act 2014 defines a “component”, in relation to a contract, as a part of the contract that is to be treated distinctly from other such parts in determining the price payable under the contract

Completion reports: For the purposes of this analysis, the Contract Completion Report/Component Completion Reports (CCR) and the Contract Costs Statement (CCS) have been grouped under the label of ‘Completion reports’.

Compliance Notice: A notice issued by the Secretary of State to a person who has contravened section 31 of the Defence Reform Act 2014 (for example, by failing to comply with reporting requirements) where there are steps that can be taken by the person to remedy the contravention. The notice will specify those steps to be taken and will direct the person to take them. The legislation sets a time limit of six months from the relevant submission due date by which the MOD may exercise its power to issue compliance notices for a failure to comply with reporting requirements.

Component Completion Report and Contract Completion Report (CCR): A completion report required under regulation 27A and regulation 28 (respectively) of the Single Source Contract Regulations 2014.

Contract Costs Statement (CCS): A completion report required under regulation 29 of the Single Source Contract Regulations 2014.

Contract Initiation Report (CIR): The collective term for Initial reports, i.e. the Contract Pricing Statement (CPS), the Contract Reporting Plan (CRP) and the Contract Notification Report (CNR).

Contract Notification Report (CNR): An initial report required under regulation 25 of the Single Source Contract Regulations 2014.

Contract price: the price payable under a QDC or QSC, determined in accordance with one, or a combination, of:

• • the default pricing method, applying the formula:

Price = (Contract Profit Rate x Allowable Costs) + Allowable Costs, and/or

• • an alternative pricing method, in accordance with the relevant provision (contained in Regulations 19A – 19G).

Where a QDC or QSC contains components, the price payable is determined in accordance with:

• • Regulation 19G (aggregation of components), or

• • The sum of the prices payable for each component

Contract Pricing Statement (CPS): An initial report required under regulation 23 of the Single Source Contract Regulations 2014.

Contract reports: Reports on qualifying defence contracts as described under Part 5 of the Single Source Contract Regulations 2014.

Contract Reporting Plan (CRP): An initial report required under regulation 24 of the Single Source Contract Regulations 2014.

Correct first time: Where the SSRO or the MOD has reviewed a report submission in DefCARS that is complete and meets the requirements of the legislation with no issues raised.

Correct on subsequent submission: Where the SSRO or the MOD has reviewed a report submission in DefCARS and raised an issue which has resulted in the contractor either submitting a correction report to rectify an error or providing additional information required by the legislation.

Date became a QDC/QSC: Either the date the contract was entered into, or if it is a contract brought into the regime following an amendment, the date of the amendment.

Defence Contract Analysis and Reporting System (DefCARS): The SSRO maintains DefCARS to enable contractors to comply with the requirement to submit reports electronically and provides guidance on its use which is relevant to all contractors using the system to prepare and submit contract reports.

Defence Reform Act 2014 (DRA): The primary legislation applicable to qualifying contracts.

Estimated Rates Agreement Pricing Statement (ERAPS): A supplier report required under regulation 38 of the Single Source Contract Regulations 2014.

Estimated Rates Claim Report (ERCR): A supplier report required under regulation 36 of the Single Source Contract Regulations 2014.

Examination Notice: Written notice issued by the Secretary of State to a person to entitle the MOD to examine relevant records within the timeframes defined under regulation 21 in the Single Source Contract Regulations 2014.

Global Ultimate Owner (GUO): For analysis of contract reports, the SSRO has grouped contracting companies into their respective GUO by considering whether the GUO controls a majority (greater than 50.01 per cent) of the voting rights of the company in question. Where a company has no single entity with a controlling majority, the company itself is considered the GUO of the corporate group.

Initial reports: For the purposes of this analysis, the Contract Pricing Statement (CPS), Contract Notification Report (CNR) and the Contract Reporting Plan (CRP) have been grouped under the label of ‘Initial reports’.

Interim Contract Report (ICR): An update report required under regulation 27 of the Single Source Contract Regulations 2014

Issue(s) raised: Where the SSRO or the MOD has reviewed a report submission in DefCARS and raised an issue in the system for the contractor to review and respond accordingly.

KPI: Key Performance Indicator(s) as set out in the SSRO’s Corporate Plan which is published on our website.

Overhead reports: For the purposes of this analysis, the Qualifying Business Unit Estimated Cost Analysis Report (QBUECAR), Qualifying Business Unit Actual Cost Analysis Report (QBUACAR), Actual Rates Claim Report (ARCR), Estimated Rates Claim Report (ERCR), Estimated Rates Agreement Pricing Statement (ERAPS) and the Rates Comparison Report (RCR) have been grouped under the label of ‘Overhead reports’.

Penalty Notice: A notice issued by the Secretary of State requiring a person to pay a penalty where either the person has failed, without reasonable excuse, to take the steps specified in a Compliance Notice, or has contravened section 31 of the Defence Reform Act 2014 (for example, by failing to comply with reporting requirements) and there are no steps that can be taken by the person to remedy the contravention.

Qualifying Business Unit (QBU): A unit which meets the threshold conditions set out in the legislation and carries out activities for the purposes of an undertaking and for which separate financial accounting statements are produced; or an undertaking or group of undertakings for which a single set of financial accounting statements is produced which is separate from the financial accounting statements of each of these undertakings.

Qualifying Business Unit Actual Cost Analysis Report (QBUACAR): An overhead report required under regulation 35 of the Single Source Contract Regulations 2014.

Qualifying Business Unit Cost Analysis Report (QBUCAR): Overhead reports constituting Qualifying Business Unit Actual Cost Analysis Report and Qualifying Business Unit Estimated Costs Analysis Report.

Qualifying Business Unit Estimated Cost Analysis Report (QBUECAR): An overhead report required under regulation 37 of the Single Source Contract Regulations 2014.

Qualifying Defence Contract (QDC): A non-competitively procured defence contract entered into on or after 18 December 2014 with a value of £500 million or more (if entered into prior to 31 March 2015), or £5 million or more (if entered into on or after 31 March 2015). Non-competitively procured contracts with a value of £5 million or more and entered into before 18 December 2014, and competitively procured contracts with a value of £5 million or more, may become QDCs if they are amended without competition on or after 18 December 2014 and the parties agree to them being brought within the regulatory framework.

Qualifying Sub-contract (QSC): A sub-contract that has been assessed as meeting the requirements to be a QSC, involving notice of the assessment being given in writing to the sub-contractor and the Secretary of State (or an authorised person). The requirements for a sub-contract to be a QSC include that it is not the result of a competitive process, is valued at £25 million or more and delivers anything for the purposes of a QDC or another QSC. The Defence Reform Act 2014 specifies the circumstances in which a contract will be a QDC or a QSC and sets out relevant exclusions and exemptions.

Quality: The assessment of the quality of submissions using performance indicators that are based on a ‘pass or fail’ assessment, so a single error in a report will result in a fail assessment, which in the case of a reporting matter impacts the quality rating for that submission.

Quarterly Contract Report (QCR): An update report required under regulation 26 of the Single Source Contract Regulations 2014.

Rates Comparison Report (RCR): A supplier report required under regulation 39 of the Single Source Contract Regulations 2014.

Regulations: Please refer to the definition of Single Source Contract Regulations 2014.

Single Source Contract Regulations 2014 (Regulations): The Single Source Contract Regulations 2014 are secondary legislation provided for under Part 2 (‘Single Source Contracts’) of the Defence Reform Act 2014. Collectively the Defence Reform Act 2014 and the Single Source Contract Regulations 2014 represent the legislation that governs the Single Source procurement framework.

Single Source Regulations Office (SSRO): The SSRO is the regulator of the single source procurement framework. It is an independent arm’s length body, whose aim in carrying out its functions is to ensure that good value for money is obtained for the UK taxpayer in Ministry of Defence expenditure on qualifying defence contracts, and that single source contractors are paid a fair and reasonable price under those contracts.

Small and Medium sized Enterprise (SME): Defined by Commission Recommendation 2003/361/EC of 6 May 2003. Extract from Article 2 as follows: ‘The category of micro, small and medium-sized enterprises (SMEs) is made up of enterprises which employ fewer than 250 persons and which have an annual turnover not exceeding 50 million euro, and/or an annual balance sheet total not exceeding 43 million euro.’

Small or Medium Enterprises Report (SMER): A supplier report requirement under regulation 45 of the Single Source Contract Regulations 2014.

Strategic Industry Capacity Report (SICR): A supplier report required under regulation 40 of the Single Source Contract Regulations 2014.

Strategic Reports: For the purposes of this analysis, the Strategic Industry Capacity Report (SICR) and the Small or Medium Enterprises Report (SMER) have been grouped under the label of ‘Strategic reports’.

Statutory Reports: In relation to any QDC (or QSC) the primary contractor (or sub-contractor) must provide statutory reports as described in Part 5 of the Regulations. The SSRO has provided separate reporting guidance that will assist defence contractors with preparing and submitting the reports required.

Supplier reports: Reports on overheads and forward planning as described under Part 6 of the Regulations.

Timeliness: Contract reports and supplier reports that are submitted within the timeframes specified under Part 5 and Part 6 of the SSCR.

Ultimate Parent Undertaking (UPU): The analysis of supplier reports is performed by UPU, rather than GUO. The legislation refers to the ‘Ultimate Parent Undertaking’ to be consistent with the Companies Act 2006 which defines ‘parent undertaking’ and ‘subsidiary undertaking’, however contract report submissions do not identify the UPU and so GUO is used instead.

Update reports: For the purposes of this analysis, the Quarterly Contract Reports (QCR), the Interim Contract Reports (ICR), the On Demand Contract Reporting Plan (OD CRP) and the On Demand Contract Pricing Statements (OD CPS) have been grouped under the label of ‘Update reports’.