Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, May 24, 2018

Official Report 495KB pdf

---

Section 22 Report

---

“The 2016/17 audit of NHS Tayside: Financial sustainability”

Item 2 is the 2016-17 audit of NHS Tayside. I welcome our witnesses, Shona Robison, the Cabinet Secretary for Health and Sport; Paul Gray, the director general for health and social care at the Scottish Government and the chief executive of NHS Scotland; and Christine McLaughlin, the director of health finance at the Scottish Government. I invite the cabinet secretary to make a short opening statement.

Thanks very much, convener. The committee will now have had the chance to read the latest report from Grant Thornton on financial governance at NHS Tayside, and members will, no doubt, share my concerns at the findings of that review. As I have said before, I take very seriously issues regarding financial management and governance, as well as ensuring that action is taken to address issues that are highlighted through the assurance processes that we have in place.

It is essential that all parties take stock, following each of the reviews of the position at NHS Tayside, and that we all learn lessons and make improvements for the future. I remain committed to immediately addressing the issues that have emerged at NHS Tayside, along with ensuring that the national health service and the wider health and social care services meet the needs of the people of Scotland effectively and at the right time. Therefore, as a starting point, I confirm that the Scottish Government and NHS Tayside have accepted all the recommendations in the Grant Thornton report and that I have received confirmation that an appropriate response to the findings will be provided by the end of June. I will ensure that the committee is kept informed of those responses.

In relation to NHS Tayside, the report underscores the need for fresh, strong leadership, which Malcolm Wright and John Brown are now providing. More widely, there are clearly lessons to be learned by all relevant parties, including the Scottish Government, and I am determined that those lessons will be swiftly embedded into our existing control systems. In addition to the change in leadership at NHS Tayside, which I am happy to discuss in more detail, a range of other work is already under way to strengthen the existing processes to prevent such a situation arising again.

The committee will be aware of the work that is being carried out by the Office of the Scottish Charity Regulator in relation to the charitable aspects of the endowment issue in advance of the completion of that work. Paul Gray has agreed with David Robb, the chief executive of OSCR, that consideration will be given to a legislative change to ensure a clearer separation of roles between health boards and their charitable arms. The Scottish Government has also taken a number of actions to improve the controls around allocations to NHS boards.

I was pleased to note Grant Thornton’s recognition of the work that has been done to date to promote an open and transparent culture within the accountable officer and director of finance groups. I give you an assurance that that approach will be maintained, expanded and embedded as we move forward in the pursuit of transformational change in the NHS.

On the transformation of NHS Tayside, I reiterate my confidence in the new leadership, which will make a real difference. I am aware that the committee hold Malcolm Wright in the same high regard as I do, and I take reassurance from his publicly stated view that the problems in NHS Tayside are fixable with strong leadership and good governance. I believe that he and John Brown are the right people to put those things in place.

Thank you very much for that statement, cabinet secretary. I will kick off with an opening question. The Grant Thornton report lays out for us a series of—I do not know a better way to describe them—errors and blunders in a very messy governance situation at NHS Tayside that led to the constitution being suspended and then to the issue that you and I were both concerned about—the transfer of charitable moneys raised in Tayside to core funding. To what extent can the public expect your office and the Scottish Government to be held accountable for a situation such as that?

Restoring public confidence in NHS Tayside generally is hugely important. As you say, when people give charitable donations, they expect those donations to be used for the purposes for which they were given. The Grant Thornton report makes it very clear that those issues were never escalated or reported to the Scottish Government, so neither I nor my predecessor, who was in post at the time, were made aware of the issues that emerged and were decided on or the actions that were taken in January and February 2014.

That raises questions about both internal and external audit, where there are lessons to be learned. When something like that has occurred, as the Grant Thornton report says, there should not have been just a factual statement; it should have been reported on and escalated to the Scottish Government so that either my predecessor or I would have been made aware of the situation well before the timeframe in which we were. In order to make sure that all the issues are looked at going forward, there is a need to address the governance issues and the internal and external audit issues as well as to make sure that there is a culture of openness and transparency.

It has emerged that the behaviours and the retrospective payments at NHS Tayside are not being replicated in other boards, but OSCR is looking at all of the returns from other boards. Indeed, the recommendation to separate the role of the trustee and the role of the board member is important, because the Grant Thornton report lays bare the fact that there was a conflict of interest when people were sitting with those two hats on. We will pursue those issues with OSCR and make sure that changes are made to avoid a situation like that ever being allowed to happen again—including through the strengthened governance processes that are already under way, which Christine McLaughlin has been overseeing.

The Grant Thornton report says that inquiries were made to the Central Legal Office to get advice on the suspension of the constitution and whether the transfer was going to land the board in legal difficulties. Does your office—your ministry—have any contact with the CLO? Is it allowed to flag up—and did it flag up to you—that that was happening and that it had been asked for that advice?

I was the Minister for Commonwealth Games and Sport at the time, but there is absolutely no evidence that the matter was flagged up to the previous cabinet secretary or, indeed, to the Scottish Government. Of course, we use the CLO for advice, but Grant Thornton lays bare a number of things. It says that the request was made of the CLO on the same day as the meeting and that the advice that was obtained was

“never shared in its entirety with the Trustees or NHS Board. Certain sections were extracted by Management and presented to Trustees in the form of frequently asked questions in April 2014 but this was only extracts.”

To be frank, I think that the trustees were only given part of the advice—again, OSCR is looking into that in more detail, and we have not had its report yet. Had the trustees been given the full advice, they might have taken a different view. The CLO provided what it thought was rounded advice, but it did not know that only part of that advice was then given to the trustees. As you say, the behaviours around that meeting were totally unacceptable.

I will ask Paul Gray the same question. Were you made aware that the CLO had received such an inquiry?

No, I was not.

Is the CLO obliged to flag up something like that to you?

No, it is not. The Grant Thornton report has caused me to reflect on the extent to which other parts of the health service might consider escalating issues of concern either to their own accountable officer—the CLO is within NHS National Services Scotland—or to me. I am reflecting on that and will have a discussion with NSS and with the current head of the CLO about points at which the CLO may consider it appropriate to raise issues of concern if it feels that its advice is being either partially used or not taken.

Let me get this straight: the CLO is a part of NHS Scotland, of which you are the chief executive.

That is correct.

It was approached on that day for advice by NHS Tayside, asking whether NHS Tayside could do something that sounded quite illegal, and the CLO clearly had misgivings about what it was being asked. Yet, at no point did it flag up to you, as the chief executive of NHS Scotland, that it was being asked for that advice.

No, it did not.

I have a further point to make. I am sure that this will come out more in the OSCR review, but client confidentiality is an important part of the legal advice that is given to NHS boards. Also, there is a very large difference between things appearing to be illegal and being inappropriate. The CLO would have given advice on the legality of the proposal in relation to the National Health Service (Scotland) Act 1978 rather than in relation to the charities acts, but it would have given legal advice—it would not have been in a position to give advice on, for instance, whether the proposal complied with the national guidance at the time. We need to pick up on and be very clear about the difference between advice about application of the law and advice on the broader implications regarding fit with guidance.

Are you suggesting that CLO staff act more as lawyers for each board rather than as in-house lawyers, checking that NHS Scotland is acting legally in all its actions?

No—sorry. The point that I was trying to clarify is that the CLO would have been asked to give legal advice rather than broader advice about fit with the national guidance that we published. OSCR will look at all of that in the round. It will look at the legal advice along with the application of the national guidance.

The other important point is that there was an intimation that OSCR had also been asked for advice on the matter, which it had not. There is no evidence of OSCR ever having been asked for advice, but there was an intimation—again, to the trustees—that it had been. The other side of the equation is OSCR, and it was not asked for advice.

Indeed. Nevertheless, it concerns me that, although you are responsible for the NHS in Scotland, the conversation about potentially illegal action that was taking place among officers of NHS Scotland was never flagged up to the person in charge—Mr Gray.

I ask Liam Kerr to continue the questioning.

09:15  

I will continue on that point. The Grant Thornton report seems to point the finger very squarely at the management of NHS Tayside as it existed at various times over the past few years—in particular, at the former finance director. It suggests that some of his practices and the culture were particularly challenging. Do you accept the analysis that the issue was isolated to the former NHS Tayside management?

The reason that we asked boards to give returns to Paul Gray was to make sure that there has been no retrospective use of endowment funds—if that is what you are talking about specifically. The returns that we have had do not indicate that what happened in NHS Tayside has happened in any other board, but OSCR will report on all of that in detail, so we will need to wait for its report.

The issue flags up the fact that there was a fundamental conflict of interest in the trustees’ making decisions on the use of those endowment funds while, at the same time, being put under pressure around the board’s finances—being asked to wear those two hats simultaneously and make decisions on the basis of the partial information that was given to them.

I do not believe that those behaviours and actions are at all widespread in the NHS; I think that there was a particular issue of a lack of openness and transparency. There was a certain culture around decision making in NHS Tayside. For example, the Grant Thornton report lays out quite clearly the pressure that was brought on the internal auditor to change the report between the draft and the final report. I do not think that such behaviours are widespread across the NHS, thankfully.

The former finance director features fairly prominently in the Grant Thornton report. He has now departed, with no process for examining his role at various times. How is his side going to be heard? I think I am right in saying that Grant Thornton has not listened to what he has to say about the matter. Is anyone going to listen to his version of events?

He has retired. Christine McLaughlin may be able to relate a little bit about some of the further action that has been taken, but I guess that there would have been no obligation on him to speak to Grant Thornton. I do not know whether Grant Thornton asked to speak to him.

That is correct. The Grant Thornton review did not involve any interviews with anyone who is no longer an employee of the board. OSCR, in its review of the issues in relation to the use of charitable funds, is able to interview any of the trustees at the time or anyone who was involved, so I can follow the matter up with OSCR. It would be perfectly within its remit to speak to any of the trustees at the time of the transaction, and the former director of finance would have been one of those trustees.

It would be worth finding out whether the former director of finance, in particular, will be listened to. There are some aspersions cast upon what went on, and it would be worth hearing what he has to say.

The Grant Thornton report also talks about several of the issues that we are examining being reported to the board in 2013-14. Why did the Scottish Government not know about the problem if the board was having those issues reported to it?

The Grant Thornton report makes it clear—it says this a number of times—that it was

“unable to identify any evidence that demonstrates the use of endowments was raised and discussed with SGHDS”—

the Scottish Government. It says that there was factual comment and that there were statements in terms of both internal and external audit. However, I would have expected something like that to be escalated and reported to the Scottish Government. As a minister, I would rely on that being the case; otherwise, we would be left in the situation of having to go through every set of accounts and read between the lines, which is not how internal and external auditing processes should work.

When something like that occurs, I would expect it to be given a red flag, escalated and reported on, but Grant Thornton is very clear that that did not happen. That is why the matter has emerged only four years later, as a substantial issue. Again, there are lessons for all of us to learn. There are clearly lessons to be learned around the governance and auditing processes in boards, and a lot of that has already happened, but there are also lessons for external audit, which we rely on to pick up issues.

A lot of things have improved since then. We see that, in 2013-14, there were verbal updates rather than written ones. The finance and resource committee is the place where the real scrutiny of the situation should have happened; yet, at the time when there were discussions with endowment fund trustees about the level of deficit, that deficit was not formally in written documentation, it was not discussed at the finance and resource committee or at the board, and it did not appear in the monthly financial returns to the Scottish Government. That level of financial exposure was not part of the formal reporting, either within the board or to the Scottish Government. The tie-up with what was reported to endowments is when it would have been identified, and, to me, that was a key financial governance weakness at that time.

There have been a lot of changes and improvements to the financial transparency in NHS Tayside, and the current director of finance is making more improvements to the reporting so that such situations will not occur now. The year 2013-14 is the year in which there is evidence of that lack of transparency within the board and in reporting to the Scottish Government.

I would like some clarity on that, cabinet secretary. In your statement to Parliament, you said:

“no health minister could have picked up on something that internal and external auditors did not flag up.”

I am hearing you make a similar point today. When talking about the auditors, you said:

“we rely on their processes in order that we can do something about such issues.”—[Official Report, 17 April 2018; c 21.]

I might be reading it wrong, but I have downloaded the annual report to members and the Auditor General for Scotland for NHS Tayside for the year ending 31 March 2014, which is dated June 2014. On page 5, it says:

“NHS Scotland directors of finance were informed on 1 August 2013 that ... NHS endowments required to be consolidated into host board accounts with effect from 2013-14.”

On page 8, it says:

“As such, NHS Tayside has consolidated the Tayside health board endowment fund into their 2013-14 accounts, using the template provided”.

What am I missing here?

Grant Thornton is very clear about that in its report. It has looked at all that, and it said:

“NHS Tayside’s Board’s External Auditors identifies the use of endowment money to support the achievement financial break-even in 2013/14 within the executive summary of their Annual Report ... This is a factual statement extracted from the wording in the NHS Tayside’s Corporate Governance Statement. There is no further commentary on this, and no associated action identified.”

It talks a number of times about the fact that one would have expected that issue to have been specifically escalated to the Scottish Government. Grant Thornton was very clear that that did not happen.

That means that the Scottish Government knew about it, does it not? In 2014, PWC clearly said that NHS Tayside had rolled the endowment fund into its other budgets.

The Scottish Government received the final signed copy of the financial statements at the end of June 2014, but Grant Thornton has been

“unable to identify any evidence that demonstrates the use of endowments was raised and discussed”

with the Scottish Government—

But I did.

That is an independent report, not my report.

Can I clarify something? The year 2013-14 was the first year that endowment funds were consolidated into board accounts. You will find that statement in every board’s accounts for that year. I realise that this adds another dimension to things, but there was a factual consolidation of endowment funds for the first time in 2013-14, in line with accounting standards, and every board had a factual statement to say how much was consolidated into the accounts. That is entirely separate from the retrospective use of endowment funds, which is covered later in the governance statement in the accounts.

If you look at all boards’ accounts, you will see that we asked everyone to insert that statement into their accounts, to be clear that the NHS endowment funds were consolidated into the accounts of the boards. The particular paragraph that you are reading out is not related to the retrospective use of endowment funds.

Be assured that if it had been escalated to the Scottish Government and indeed to either my predecessor or me, action would have been taken, but it was not. Grant Thornton confirms that in its independent report.

Ms McLaughlin, forgive me, but Liam Kerr and I are both looking at each other. We are not accountants. Perhaps you can explain in more understandable terms what that means.

Until 2013-14, NHS endowment funds were entirely separate and did not sit within the accounts of the NHS board. When you look at the annual statements for previous years, you will not see reference to endowment funds. In 2013-14, endowment funds were for the first time consolidated into NHS board accounts, so when you look at NHS board accounts now, you will see an inclusion of the income and expenditure related to endowment funds within the board’s exchequer accounts. That change to accounting practice brought endowment funds into the accounts for the first time in 2013-14, so there is factual reference in all the boards’ accounts to say, for the first time, that charitable funds are included within the accounts of the board.

I understand.

You are absolutely right that, later on, the accounts make reference to the retrospective use of endowment funds. However, the particular point that Liam Kerr is highlighting is not related to the retrospective use.

I now understand, but the PWC report goes on to say:

“As with any new reporting requirements, this change”—

which you have just outlined—

“increases the risk of error or misstatement in the financial procedures.”

Would that not require you to then check whether something had been transferred from endowment funds to core funding?

I am sure that the Auditor General can give you a better explanation of this than I can, but what that means is that there is a requirement to check the factual accuracy of the income and expenditure related to endowment funds in the annual accounts of the board. In doing so, the external auditor relies on the external audit of the endowment funds to verify those amounts. You are right: it increases the risk of misstatement, because the auditor relies on the external audit of the endowment funds to make sure that those numbers are accurate.

There is a separate statement in the accounts about the retrospective use of endowment funds, and that is the point at which there is reference to this transaction. I am happy to follow up and clarify that. I would differentiate between a technical accounting consolidation, which is in all board accounts, and the retrospective use of endowment funds, which relates just to Tayside.

Would that change have been flagged up to OSCR? If OSCR knew about that change when it did its audit of charitable funds, can we expect in the OSCR report some further information about who knew what when?

The endowment funds are audited every year. A set of accounts on endowment funds are submitted to OSCR and they are put on OSCR’s website. That process did not change at all. What was new in that year was that the accounts were also consolidated into board accounts. I would see that as probably being beyond OSCR’s remit, but I can certainly clarify that for you.

That would be very helpful, because we are trying to establish who knew what when, particularly as it seems that there was a four-year period before the issue was properly flagged up, and the cabinet secretary has rightfully said in Parliament that there are issues about the audit trail. It would be very helpful if we can uncover exactly who knew what when.

The OSCR report will obviously focus on the role of trustees and endowments, and we will wait and see what it produces.

This is really concerning. We had a situation in which NHS Scotland directors of finance, Audit Scotland and the Scottish Government all knew that there had been a change in accounting practices that meant that endowment fund accounts would suddenly be within board accounts for that year, but nobody thought to check that any health board was taking advantage of that by transferring funds from endowment funds to core funding. It looks as though that is exactly what NHS Tayside did. It took advantage of the new accounting mechanism that you had put in place, and nobody thought to check that.

09:30  

I do not think that that is an accurate reflection.

What is an accurate reflection?

The 1978 act allows boards to use endowment funds for the advancement of health. To see the consolidation of accounts as something that could be taken advantage of is incorrect. It was merely about including the accounts in the board accounts at the year end.

You may disagree with my wording “took advantage”, but you changed the accounting standards for NHS boards. Endowments suddenly become part of them in 2013-14, and we find that in the 2013-14 financial year, NHS Tayside transferred charitable funds over into core funding. Is that not a huge coincidence? Did nobody think that, because there were new accounting standards, somebody had to check that charitable funds did not end up where they should not have been, which is exactly what happened in Tayside?

I would make the point that that could have happened in any year. It was not related. I understand your—

What I am asking is, did nobody think to check whether funds were being transferred because of the new accounting standards?

I think that we are talking about two different things. I think that the behaviours—

No, I do not think that we are. Can I ask Christine McLaughlin that question? Did your office think to check whether funds were being transferred because of these new arrangements?

We gave guidance to boards about the way in which the consolidation would happen and what they would show in their accounts. The use of endowment funds is not related to the consolidation of accounts, so if endowment funds were used for those particular projects in 2013-14 or the year before, it would have happened in exactly the same way. The change that we are talking about was merely about including the values in the accounts at the year end. If I am giving you the impression that the boards suddenly had a mechanism to use that was not there before, that was not the case. The mechanism by which boards can use endowment funds was exactly the same in that year as it was the year before.

What I am saying is that there was a change in accounting practice that brought those two things together. The PWC report says that that

“increases the risk of error or misstatement in the financial procedures”.

Did you not recognise that risk and think to check it?

We did recognise the risk. We issued guidance to the boards on how to undertake the consolidation. The role of the auditors was then to assure, through the external audit of the endowment funds, that the correct values were included in the accounts.

So your way of dealing with that risk was to issue guidelines, rather than to check the accounts.

It was to issue guidelines and to ensure that the accounts were consolidated accurately as part of the annual accounts process.

The checking of accounts is internal and external audit’s job.

Yes, and we are going to come on to that.

I would be very happy to provide some further guidance on what I have just talked about, if that would be helpful.

That might be useful, yes.

Cabinet secretary, I wanted to track back a little bit to one of the answers that you gave to Liam Kerr. You talked about the behaviours and actions that have taken place in NHS Tayside and you said that you believe that those behaviours and actions were not widespread in other boards. For the avoidance of doubt, do you believe that those behaviours and actions were unacceptable?

Of course.

Good. We have spent quite a lot of time prior to today and today trying to find out what happened in NHS Tayside and who did what, and I hope that you will have reflected on why these things happened. A number of senior managers in NHS Tayside undertook behaviours and actions that we have agreed were inappropriate and unacceptable. I am keen to know why you think that they felt they had to do that. There does not seem to have been any personal gain to any of them. In fact, a number of them have lost their positions as a result. Why do you think they felt constrained to behave in that way?

I think—and Grant Thornton confirms this—that, as Christine McLaughlin was talking about earlier, there was a culture of lack of openness and transparency, with verbal reports instead of written reports. I think—Grant Thornton also talks about this—that at the time there was a desire, particularly on the part of the chair, to produce a break-even position. If you read what flowed from that, with regard to the pressure that seems to have been applied to trustees, you see that it talks about the consequences for patient care of not making those retrospective payments. I think that it says that there would have to be cuts and so on and so forth. Yet at that point, a brokerage arrangement would have been open to the board, if it was necessary, and that is what it ended up with anyway.

Grant Thornton lays bare that there appears to have been a determination to go down a particular route, that the normal procedures and processes were set aside to enable that to happen, and that the information that was provided to trustees to get that outcome was only partial information. To me, all of that says that there was a process that lacked openness and transparency and that that led to the actions that are laid out in the report.

Surely what you are saying is that the chair was trying to pursue a balanced budget, which was impossible to achieve. What was driving those actions, which may have been covered by the cloak of a lack of transparency, was the attempt to balance a budget that it simply was not possible to balance. Is that not fair?

There were other options available to the board, such as brokerage arrangements. There was obviously a lot of work—

NHS Tayside had drawn down brokerage on a number of occasions, had it not? Surely brokerage is a way of dealing with difficulty in balancing the budget in a particular year. Are you suggesting that brokerage year after year would be effective financing of this NHS board?

No, I am not, but NHS Tayside was required to get its financial position into a better place and it had to live within its means. There is obviously a history of NHS Tayside perhaps not doing that in the way that it should. It was an outlier in a number of areas.

Was that not the pressure?

Yes, but the choices that were in front of it did not require it to go down the road of the retrospective use of endowment funds. It could have had brokerage arrangements in place if they had been required. It chose—or certain parts of the leadership of NHS Tayside chose—to go down a route that required it to set aside the normal rules. That is not something that other boards were doing; it was a particular course of action that certain members of NHS Tayside’s senior leadership team clearly chose to do at that point. That was not the only option open to NHS Tayside and it was wrong for choosing that route.

We can agree that it was wrong for choosing that route. You have made it very clear that you think that it was, especially given the action that you have taken, but I come back to what you just said: that the board was required to get its finances into a better state. Do you not think at all that that pressure might have led it to take what we agree were bad choices? Have you reflected at all on the financial pressures that were being put on the board?

I do not think that there is any excuse for the action that was taken. There were other options open to NHS Tayside that it was well aware of. Discussions could have taken place with the Scottish Government financial officials to get to those options. That is what other boards have done and will continue to do to help themselves get to a financial balance. It was unusual, and thankfully it appears so far—OSCR has still to confirm this—to have been an isolated case. It appears to have happened only in Tayside, and that tells us that they were not the actions that a board would normally take.

Forgive me for labouring a point, but I would like to raise the issue of what the executive summary of the PWC report that I referred to says about financial performance. I will put this to Christine McLaughlin in the first instance, because it has been quite clear that there was no flag put up to say that there had been an issue with the endowment funds. Halfway down the executive summary, it says:

“In February 2014 the board of trustees of the Tayside NHS board endowment fund approved a number of submissions for funding totalling £3.64 million, of which £2.71 million was retrospective spend. In total the board has received £7.6 million of endowment funds to fund projects outside of the core activities within its 2014 financial plan.”

What am I missing? Why is that not a flag that says there was a misuse of endowment funds?

That is the factual statement that I said is in the accounts. I do not think that we have ever said that the transaction was not factually included in the accounts. It did not suggest—

It was there to be seen by the Scottish Government and by the Scottish NHS. They knew.

That was included in the accounts as a transaction. That does not suggest that it was an inappropriate transaction. Later on, the statement says that there was not anything inappropriate in the accounts. The board, as part of its annual assurance process, writes to the Scottish Government, and that is the point at which the audit committee of any board should flag anything that it feels needs to be raised from the accounts. The letter from the board said that there was nothing to make the Scottish Government aware of.

So, because PWC did not write down, “Scottish Government, there is something not right here,” that exonerates the Scottish Government from any—

Auditors would normally escalate matters of concern to the Scottish Government. That is part of what their role is, and that did not happen on this occasion. If it had happened, Alex Neil or I—depending on when the issue was raised—would have taken action. The fact that it was not escalated to the Scottish Government and never came to the attention of ministers is proof in itself. There are questions about internal and external audit, because we would expect something as serious as this to be escalated. In terms of lessons learned, there are issues for us all to reflect on about that.

Forgive me, but the report that Liam Kerr has was given to your office.

I have never received a report that says, “This is a matter of concern that a minister should be looking at.” As Grant Thornton says—

If you will let me finish, this report from PWC, dated 10 June 2014, was submitted to the Scottish Government. Is that correct, Paul Gray? It is the annual report to members and the Auditor General for Scotland for NHS Tayside. Your office would have received a copy of this.

There is a factual statement in there, as we have just said—

The statement says that the funds were used retrospectively—that endowment funds were used to fund core spending. Is what you are telling me, cabinet secretary, that for something to come to the cabinet secretary’s attention, it must have “matters of concern” or “red flag” written at the top? That statement was included in the report that was submitted to your office.

As Grant Thornton said in the report—I am sure that you have read it—it has

“been unable to identify any evidence that demonstrates the use of endowments was raised and discussed with the Scottish Government”.

But we have.

A factual statement is not the same as a matter being escalated. A matter coming to ministers would have to be escalated to ministers. That did not happen when Alex Neil was cabinet secretary and it never happened—

But there is a report that has been submitted to the Scottish Government saying that this happened—that

“the board of trustees of the Tayside NHS board endowment fund approved a number of submissions for funding totalling £3.64 million, of which £2.71 million was retrospective spend”.

It is in the report that was submitted to your office, so why was that not acted on?

I have never had a matter of the retrospective use of endowment funds in Tayside escalated to me as a minister. The cabinet secretary previous to me—

But, cabinet secretary, this report came to your office. Paul Gray, is it not the case, that you—

A factual statement is not the same as a matter being escalated by auditors.

But this is a factual statement. It is on a piece of paper, in a report that came to your office.

We have all agreed that it is a factual statement. That is what Grant Thornton says, it is a factual statement, but the matter was never escalated to the Scottish Government as a matter of concern.

What constitutes escalation? Not a report that has the words written?

In auditing terms, there are clear processes for escalation that auditors would follow if they have a matter of concern. They do that either through qualified accounts or through a matter being put to the Scottish Government. That did not happen on those occasions. In auditing terms, that would be the process, and that is what happens in other cases.

Are you saying that there is no point in PWC submitting such a report to your Government because it will not be read? Are you saying that what will be acted on is only something that says “matters of concern” at the top of it?

09:45  

In terms of auditing process, what we would expect is that, if the auditors have a concern, they escalate that concern. They should not include a factual statement as part of an audit report, but should escalate the issue as a matter of concern. It is the role of auditors to escalate matters of concern.

Was this report read, Paul Gray?

I cannot recall if I read it in 2014. I am not going to pretend that I know, because I cannot recall specifically what I read in 2014. Christine McLaughlin, are you able to advise the route that that report would have taken?

If I can clarify, as you will be aware, the board accounts go through a level of scrutiny within the board, including the audit committee, and are then submitted to the board for final sign-off. There is an extent to which there is reliance on that assurance process, which we have talked about before, in relation to the internal audit process and the external audit process. Something would be escalated to the Scottish Government if there was something raised that was a material misstatement or something that involved a suggestion of a section 22 report.

Every audit committee writes to the Scottish Government. That is a clear method of escalation in relation to any issues that an audit committee wants to bring to our attention. The letter from the board says to us that there is a nil response; there are no significant issues to bring to our attention. That is the route by which we would take something as escalation.

It is disingenuous for the Scottish Government to say that it did not know when this report with this information landed on your desk.

Can I just begin with a wee housekeeping thing, referring back to what Liam Kerr asked about the director of finance? I know that you might not be able to answer this just now, but could you let us know whether Grant Thornton gave the director the opportunity to talk to it as part of its review? I fully appreciate that, because he is retired, he could not be compelled to talk to Grant Thornton, but in the interests of fairness and justice, I would have thought that it would be fair to give him the opportunity to present his side of the story—of course, whether it is accepted is a different thing. If he was not given that opportunity, maybe you should reflect on whether he should be given the opportunity. It is up to him to decide whether he takes it.

Also, I would like to correct the convener. There is a big difference between documents being submitted to the Scottish Government and documents being submitted to the cabinet secretary’s box. If every document submitted to the Scottish Government in any department ended up in the cabinet secretary’s box then, quite frankly, the cabinet secretary’s job would be impossible.

Mr Neil, that is not what I was suggesting. It went to NHS Scotland, but if you—

No, but you were interweaving the two. This is important because of the point I am about to make. Many documents go to the Scottish Government that do not end up in Paul Gray’s box, never mind in the cabinet secretary’s box. It is important to understand that flow.

However, having said that, as the cabinet secretary said at the beginning, I think that the matter should have been flagged up—I think that we are all agreed in that. We have mechanisms in place: we have non-executive board directors whose job it is to flag these things up; we have audit committees that are run by the non-executive directors; we have internal auditors; we have external auditors; we have monitoring teams in St Andrew’s house in various functions. However, despite all of that, nothing was flagged up to the Scottish Government until recently. We are talking about events that took place four or five years ago.

Certainly, it was never flagged up to me that there was a problem. We knew that there was a financial problem, but it was never flagged up to me that there was any problem of wrongly using funds. Had it been, then obviously action would have been taken right away. Clearly, there is systemic failure in terms of picking up what has gone wrong timeously, despite all the paraphernalia that we have and all the checks and balances that are in place. They did not work.

Obviously, cabinet secretary, you have rightly said that you will implement the recommendations in full, but I am not convinced that the recommendations by themselves will solve that particular problem. Therefore, my question to you is, are you looking at other ways of managing things, whether that involves early warning systems or telling the CLO to notify at least Paul Gray’s office if it has an inquiry of an unusual nature from a board or whatever? Are you looking at how we can avoid this happening again? Very clearly, the matter was not flagged up at the appropriate time—in the same way that, when my predecessor, Nicola Sturgeon, was the cabinet secretary, a similar problem with the waiting lists in NHS Lothian was not flagged up at the right time. Have you looked at other ways in which we can ensure that issues such as this are flagged up quickly?

Yes, indeed. The recommendations are part of this, but you will appreciate that a whole load of action has already been taken. Part of that involves a culture change, particularly within NHS Tayside, because the behaviours that we are talking about were able to happen only because of a culture that was less than open and transparent. We have touched already on the fact that the internal auditor had pressure put on him to change the report, so there was clearly a deliberate set of actions to obfuscate the facts. That is an important issue.

In terms of the action taken, clearly there is a strengthening of the audit processes that is well under way and the new chair of NHS Tayside, John Brown, has been very keen to do that, and to do it very quickly indeed. There have been other changes that Christine McLaughlin can outline that have been taken forward across the NHS. There is also the work that John Brown has brought in in terms of the assessment of skills across the board to make sure that people have the right sets of skills. I think that the role of non-execs is important, but they need to have the necessary information and confidence to ask the right questions. Again, there has been a lot of leadership training to empower non-execs to be able to do that.

Again, finally, Christine McLaughlin can come in with some of the detail, but the separation out of the role of endowment trustees from those sitting on the board is an important step forward, because it would remove any possibility of that conflict of interest arising. That is something that OSCR has already flagged up as an intention and it is something that we would want to do as well. That would ensure that no one is sitting with two hats on, as was the case in Tayside.

Christine, do you want to say a little bit more about some of the work that is under way?

An important point, as you say, is how to create an environment where people feel comfortable saying that something does not feel right within the whole system. Partly, it involves making sure that there is clarity around the financial environment in which boards are operating and that we understand the different sets of pressures in different boards. Partly, what we are trying to understand is what those are and what steps boards are taking in order to provide that balance of performance and finance. For me, that is the way to improve on all of this. There are some things that we need to do in relation to governance and to the internal audit function, which is really important with regard to ensuring that we focus on the right things and flag risks.

There was certainly some evidence in Tayside of things such as internal audit actions not being followed through. For me, that is certainly something that I will be much more aware of and be looking at much more closely, because I think that it is a good sign of the pressures in a system. It is important to consider what types of issues are being raised by auditors and how are they being addressed and in what timeframe. When we go back and look at the position over the last few years in Tayside, that has certainly been one of the areas that has been identified. There was not that follow-through of key issues, although most of these things were raised in some way. There is no effort on my part not to be absolutely honest with the committee. I think that things were identified. The issue is the extent to which things came to sufficient clarity, and the extent to which there was enough understanding of the significance of issues in order to make sure that action was taken. That is why I want to focus on the whole of the system and learn from what happened in Tayside.

I have two specific questions. It seems to me that there has to be a big question mark around the role of the non-executive directors, because clearly they did not do their job. If they had done their job, none of the issues would have arisen. We have had similar problems in other organisations such as the Scottish Police Authority. What are you doing to strengthen the quality and the performance of non-executive directors, not just in Tayside but in other boards?

My second question is about strengthening the monitoring of boards from St Andrew’s house. Christine McLaughlin has referred to that in relation to her department, but the question is maybe more generally for Paul Gray. A lot of the recommendations relate to how Tayside should improve its internal checks and balances, but clearly there is also a need for on-going checks and performance monitoring in the widest sense from St Andrew’s house. It seems to me that, as well as doing something about the non-executive directors, there needs to be a substantial strengthening of the monitoring of boards from St Andrew’s house. Is that a fair comment?

A lot of work is already under way to make sure that that is the case. There has also been an attempt to recruit non-execs from a wider spectrum of society, to bring in different skills and experiences, and that is a good thing. I had a session with all of the non-execs across Scotland and I made the point that they have a critical role in questioning, but they need to have the information at hand, and so the role of the executives in providing proper open and transparent information is critical. Expanding the pool from where we draw non-execs is important in enhancing and building on those skills.

I have three things to say. First, I want to record that I have had a very useful conversation with the Auditor General about how we can learn together about what we might all do differently as a result of the issue, because there is no doubt in my mind that we do not want it to happen again. There is a joint commitment to learning what we need to learn.

Secondly, there is the Grant Thornton report and other reports, including the OSCR report to come on Tayside and the broader OSCR report on other boards and the material that I have submitted to it. We want to learn from those reports the lessons that we need to learn about things that we might do differently. The chief executive of OSCR has asked for a meeting with me, which I have agreed to, to discuss how we might best strengthen the governance of endowment funds and bring in that separation that I think—as I said in my last appearance at the committee—we are all committed to. John Brown and Susan Walsh have undertaken a review of governance in NHS Highland, with the clear intention that that should have broader applicability across all boards.

On Mr Neil’s point about monitoring from within the health directorates, he is right, but I want to be absolutely clear that we have a presenting problem—which is that an issue arose in Tayside, was not escalated and therefore was not acted on—and we need to not simply design something to fix that one presenting problem, which might not happen again, but rather make absolutely sure that, where we can strengthen the monitoring, we do so.

We are trying to address the issue on a number of fronts. As the cabinet secretary said, we have already engaged in non-executive director development and drawn out some of the lessons of Tayside for the rest of the non-executive director cohort. Mr Neil will recall that we had significant issues in NHS Lanarkshire at the end of 2013, part of which arose from weak questioning by the board. We did substantial development with that board and have brought about something of a transformation there. We are ensuring that the lessons from that are being spread to other boards as well.

Sir Lewis Ritchie has been retained to work with NHS Tayside in his audit advisory group function to ensure that there is strengthening and support for the non-executive directors there in terms of their development. We are trying to address the issues of board scrutiny and internal scrutiny and, subject to the fact that clearly we do not direct Audit Scotland, we are having a discussion with it about its external scrutiny as well. We are trying to tackle the issue on a number of fronts.

10:00  

You said that the skills review was taking place at NHS Highland. Just for the Official Report, did you mean NHS Tayside?

You are right to ask about that. John Brown is doing a skills review in Tayside but, prior to that, he was also commissioned to do work in Highland with Susan Walsh. It is the work in Highland with Susan Walsh that is designed to have broad applicability, although we will clearly learn from what comes out of Tayside as well.

So a skills assessment of the board at NHS Tayside is being done, as per your letter.

That is absolutely correct. There was also another separate and unrelated commissioned piece of work, which was relevant to my response to Mr Neil.

I first want to ask about the KPMG investigation of e-health funds. We have received a heavily redacted summary of the findings and conclusions, and key areas that are referred to in the contents, such as information on governance weaknesses, are missing and do not actually appear. Would it be possible to get the full report?

Yes, that should absolutely be possible.

The board is just going through its internal clearance with the auditors. The report was largely written for internal consumption, so there are a lot of references to individual members of staff. The board just needs to ensure that that is dealt with appropriately and then the full report will be released to the committee.

Thank you.

My next question is possibly more for Paul Gray. I assume that the NHS as a whole has some sort of risk register that is monitored periodically and that, by now, Tayside is fairly prominent on that. What are the criteria for appearing on that risk monitor? Is it if a board gets a section 22 report or requires brokerage? At what point did Tayside appear on the risk register?

I am happy to take that question, and Christine McLaughlin might add to what I say.

The criteria for appearing on the risk register at the health and social care management board are not confined to two or three aspects. They cover financial risk, governance risk, performance risk and people or human resource-type risks. That would happen if any of the relevant directors, whether the director of finance, the director of performance or the director of people, were to feel that, based on their monitoring, there was a material risk that was sufficient to cause it to be escalated. We try not to narrow the criteria, because sometimes risks can emerge in different ways. If you have a narrow set of criteria, you end up excluding genuinely material risks, because they do not quite meet some fixed criterion.

At what point would Tayside have appeared?

Do you mean on the risk register?

Yes. You may not know that off the cuff.

I will write to the committee, but I can say that it was sufficiently high on the risk register that, by March 2017, we had agreed to put in place the audit advisory group, so it had appeared sometime prior to that.

Cabinet secretary, one of the things that is highlighted in the section 22 report is the number of people who appear to have been complicit in covering up the situation that arose. As a culture, that seems astonishing. We sometimes get one or two people doing that, but here we are talking about the director of finance, the deputy director of finance, human resources staff, even, and internal audit. It just seems that there was that culture across the board. It is very difficult to get my head round how it came about.

Yes. As we touched on earlier, there was certainly a culture that was less than open and transparent, and that led to a series of behaviours that were not only tolerated but actually became dominant in some of the key decisions that were made. For example, the thing that jumped out at me was the pressure that was put on the internal auditor to change a report. Thankfully, it is unusual for such behaviours to become a dominant culture. I have not seen that level of behaviour anywhere else. We have had problems elsewhere in various aspects of other boards, but the lack of openness and transparency and the culture in Tayside at that time is in a bit of a league of its own, to be honest.

The behaviours that then followed from that are laid bare in the Grant Thornton report, which is why one of the things that the new leadership team has done is to focus on a change of culture. There requires to be openness and transparency and a culture where people feel that they can raise concerns. The message that we have imparted to the leadership team in NHS Tayside and to the staff is that that should be the culture. That might take time, but it is absolutely the right thing to do.

Are you satisfied that there has been a similar change of culture within internal audit? I am looking at what has been happening here with internal audit reports and so on being presented by management, not by internal audit, poor quality recommendations and lengthy audit reports that people probably did not understand very well. They seem to have been complicit in the whole thing.

The lack of information, partial information, verbal reports instead of written reports, and information about who presented a report is all part of the same picture of an attempt to provide at best partial information to those who were then expected to make decisions. I am sure that more will come out in the OSCR report on the specifics of the trustees’ role within that, but without a doubt, important changes have taken place to the mechanics of reporting, written reports and so on. That is important, but so is the cultural change to go alongside that, so that there can be no attempts to provide partial information. People should not be trying to do that. As well as openness in reporting, cultural change is important.

I have two questions about internal audit. First, are they still the internal auditors to NHS Tayside? Secondly, if they are, are we satisfied that they are now doing the job properly?

There have been changes.

You asked me about this the last time I was at the committee, and we have given some information about the internal auditors since that last meeting.

The board of NHS Tayside has signed off on a review, which is good practice for internal audit. An external evaluation of the internal audit standards that any internal audit should follow will be done in June. It will look at the effectiveness of the current internal audit system of controls within NHS Tayside and areas for improvement from that. That is a really good first step. It is good practice for any board and we will be looking to ensure that that is in place across all of the NHS.

The same audit group, which I believe is internal to the NHS, provides internal audit services elsewhere within NHS.

That is correct.

Are we satisfied that it is doing its job there?

As part of good practice reviews, there were already external quality assessment reviews of the functions, and FTF, which provides that in-house team, is part of the review. We would like to see what comes out of that and what the areas for improvement are but the new leadership already has improvements under way on the things that you mentioned that remain in the report about management presenting reports, lack of clarity and in particular lack of follow-through on actions. We will do that review, but you will see that improvements are already being made.

In my earlier response, I should have said that the Auditor General and I have discussed the importance that we attach to ensuring that internal audit is robust and protected. I have also discussed that with the director general for the Scottish exchequer within the Scottish Government. We will follow that up, not just in the context of Tayside, but more generally to ensure that the internal audit function is sufficiently robust to bring out the information that needs to be brought out, to escalate it to where it needs to be escalated to, and that it is protected.

There was some evidence in the Grant Thornton report that the internal auditors were put under pressure about their positions and their future. That is completely unacceptable. I made that clear at a previous committee appearance, but I assure the committee that we are following that up now and hope to make further progress on it quickly.

Internal audit clearly failed. It did not do its job. If the internal auditors were having problems or difficulties with being intimidated and so on, they should have escalated that past the management, if necessary. However, the external auditors have been signing off every year saying that internal control is appropriate. Should external audit be able to pick up that internal audit is failing?

There are lessons for internal and external audit, and the discussions that Paul Gray has been having are important in that respect. There are clearly lessons for all parts of the system here, whether it is the internal controls, the reporting mechanisms, the culture, and the internal or external audit. All lessons must be learned to make sure that there is a tightening up and that concerns are appropriately escalated. If we get all that right, it will ensure that something like this can never happen again.

I would like to ask another general question about internal audit. Are we satisfied that internal audit is doing its job across the NHS and that external audit is interfacing as it should with internal audit to ensure that this sort of situation cannot arise again? I see this largely arising because of failures in the audit system.

Can I have brief answers to that, please?

The improvements that are being put in place will deliver that. Some of that has already happened, some of it is in the process of happening, and I am sure that additional assurances on that will be delivered.

I will start by asking a simple question. Has the endowment fund been returned to the endowment trust and effectively been replaced by brokerage?

The £3.6 million will be returned.

It will be returned during the current financial year. An agreement has been made to make the transaction in 2018-19.

I presume that the fund will be replaced by brokerage anyway.

We have already offered additional brokerage to make sure. We do not want the situation impacting on patient services, so it will be part of the brokerage arrangements. The new leadership team is working on a new recovery plan, which will be robust and will give us all renewed and additional confidence in the board being able to get back into financial balance over a period of time.

You said that we would probably have ended up giving the board brokerage anyway, but as Iain Gray said earlier, this is not the first time that NHS Tayside has requested brokerage. I think that it has had it perhaps five or six years in a row. What is the role of the Scottish Government and the NHS in intervening in such repeating situations to help the board to balance its books?

In my statement to Parliament, I laid out all the work that has been done to support the board in its journey to financial recovery and to making sure that it is living within its means and tackling some of the areas where there are outliers. That work is on-going and supported to a great extent by the assurance processes and the external support.

10:15  

However, when the final recovery plan was being reported upon, the issues of e-health and endowment were raised. The new leadership is looking at where there is strength within the recovery plan, to make sure that what it proposes has an additional level of robustness, that it has the confidence of the leadership team and staff—perhaps that was lacking in the previous plan—and that it is deliverable against achievable targets over a clear timeframe. That is the task that the leadership team has been given, and what I am hearing has given me more confidence in its ability to deliver something robust that will make the substantial changes that need to be made, particularly on finance. Christine McLaughlin has been working with them quite closely.

Yes, and we expect to get a revised plan for 2018-19 by the end of this month. We will have the first draft of that from the new team next week.

In the interest of making sure that this kind of thing never happens again, are we clear about the definition and appropriate use of endowment funds? They seem to hang their hat on such funds being for the advancement of health, which could really mean anything. Are we clear about what is appropriate use of endowment funds in the future?

The guidance that has been referred to was revised in 2013. There is obviously wide scope in terms of the benefit to health, but it is clear that the retrospective use of endowment funds in NHS Tayside was totally inappropriate.

I guess that there will always be debate among the trustees about requests that the trust receives, and endowment funds will be used in various ways. The separation of the trustees’ role from that of board members will give an extra level of assurance that the endowment trustees are focusing on the appropriate use of endowment funds for additional things that are not core services. Yes, it is about the betterment of health, but it is also about those additional things that can improve healthcare for the local public.

In addition to separating the roles as I have mentioned, OSCR also wants to review the guidance further, which is a good thing. That will get us to a position where we have greater assurance. Ministers rightly have no role in the spending of endowment funds because they are charitable and OSCR has very clear rules. OSCR has recognised that the guidance needs to be revised and that the separation of the roles is important.

On the internal audit issue that my colleague Colin Beattie was leading on, you have mentioned several times that the Grant Thornton report says that the internal audit report on the use of endowment funds was changed from the draft report. The paragraph says:

“The CIA informed us that the Director of Finance and Assistant Director of Finance put pressure on him to amend the covering paper. At a meeting on 5 May 2014, to discuss the Internal Audit annual audit report, there were alleged threats made including those of the potential removal of FTF as internal auditors or the removal of him as CIA.”

That is incredibly serious commentary and the cabinet secretary and Mr Gray have referred to it several times. What is the Scottish Government doing to pin down exactly what happened to make certain that it can never happen again?

You are right—they are very serious comments indeed. Grant Thornton goes on to say:

“We are unable to substantiate these allegations, but note there were changes between the draft and final versions of the Internal Audit Endowment Annual Report covering paper (as shown above). These changes impact on the emphasis and we believe reduce the concerns initially raised.”

Although Grant Thornton was unable to categorically establish the truth of the allegations, reading between the lines, something obviously happened between the draft and the final report.

Again, Christine McLaughlin has laid out some of the work that has been undertaken on reporting, the reliance at the time on verbal reports instead of written reports, and the fact that the process needs to be open and transparent, and internal auditors need to feel that they can raise concerns if someone is being pressured into going down a particular route. A lot of work has already been done to make sure that that cannot happen again, and further work is on-going.

Do we know if the draft internal audit report or the allegation about changes to the report was escalated beyond the director of finance to anybody else?

The crux of the issue is that there is no evidence of further escalation beyond that reported position. There is evidence that the wording in the final report was different and not as strong as what was in the draft. It related to the extent to which OSCR’s advice could or should have been sought. Partly what is referred to in the report is that that may have been because there was a view that the work of the endowment fund external auditor would have covered that issue in the process, but clearly that failed to come to anything.

To be clear on two further things that should happen and be in place, the internal auditor should be able to talk to and report to the chair of the audit committee on any board. There are mechanisms to go beyond a sense of management intervention in the audit committee, but good practice should also involve routine private sessions throughout the year during which external and internal audit teams can talk in a private space to the non-executives as part of the scrutiny. There was not sufficient evidence of that kind of thing. There are most certainly areas within the strengthening and protectionist policy out of internal audit that we will want to make sure are in place and operating effectively across all of the NHS.

With the greatest of respect, I am not surprised that did not happen if it is true that threats were made to remove the person as chief internal auditor. I challenge anyone to say what they would have done under such circumstances. It is quite scandalous for anyone to have that hanging over them. I spring to the defence of the audit process here.

I joined this committee in 2007 when it was looking at NHS Western Isles. That board had completely ignored internal audit recommendations, and here we are again with another example of audit recommendations being honestly and fairly presented and changes that were made by others being ignored. I suggest to the convener and members that that is not a failure of the audit process; it is a failure of people abusing the audit process and abusing their position. The crux is how we ensure that we follow up and verify what the auditors are recommending should be done. I have asked about this over a number of years at this committee and I think that the key is supporting the audit process and making sure that recommendations are carried out. How are we planning to do that?

The recommendations in the Grant Thornton report and also the additional work that has already been undertaken recognise that and that is why those additional steps of assurance are being put in place. You are absolutely right—the culture enabled what happened to happen, but the processes did not pick up on it and stop it happening. That is the bit that largely has been sorted and is continuing to be addressed.

Willie Coffey’s line of questioning was interesting. I am looking at the Grant Thornton report, and it appears that the director of finance, the chairman and somebody called the assistant director of finance were involved. We know what happened to the director of finance and the chairman. The assistant director of finance, I think, was a chap called David Carson. Where is Mr Carson now?

He has retired from the board.

From the board of—

NHS Tayside.

Did that happen concurrently with Mr Bedford’s retirement?

I am not sure of the date when Mr Carson retired from post. I think that it was in the past two or three years, but I can confirm the date.

Thank you.

I refer to my entry in the register of members’ interests. I was a partner at KPMG, whose name appears in the documents. Of course, I had nothing to do with this particular report.

The financial irregularities at NHS Tayside on both the e-health funds and the endowment funds have been serious enough to warrant your intervention, and we have heard descriptions such as “cooking the books”. However, it seems to me that an aspect is missing from the discussions that we have heard about so far, and that is the possibility of any criminal activity. It would perhaps be to the benefit of public trust in the health board to rule out any criminal wrongdoing in these matters. It would be useful if you could explain, without prejudicing any legal case, what discussions you have had about involving Police Scotland in the matter.

The Grant Thornton report will be looked at in close detail. We have already accepted the recommendations for NHS Tayside. If there is any evidence in that report or indeed in the OSCR report that is criminal in nature, then clearly action will be taken on that basis.

I am not aware that anything has been put to us so far that is criminal or fraudulent or that involves personal gain. If anything came to light, that would be something to be considered. It is not something that we have considered to date.

I suggest to you that we have misrepresentation of public funds in a set of financial statements of a significant entity. We are not just looking over the whole piece. I would ask that you think about that.

Yes. If there was any evidence, we would—

It is for you to define that—

I know. I take your point.

Thank you. You confirmed to me on 17 April that either the Grant Thornton review or a subsequent investigation would cover who knew what in your office. You said that the investigations

“will get to the bottom of all that and make sure that there is full openness and transparency”.—[Official Report, 17 April 2018; c 22.]

Can you provide some detail on that process? Specifically, who in your office has been involved and what investigations or information have they provided?

Through all of this, in relation to the reports on e-health and the issues of endowment, we have said that we need to know how this could have happened, what communication there was and what the relationships were. In relation to e-health, that has been fully investigated in terms of the e-health officials in the Scottish Government, NHS National Services Scotland and NHS Tayside and the relationships there, and action has subsequently been taken on the back of that. In relation to endowment, again, the reason why the independent report is important is that there was an external look at all of that.

But has somebody looked into your office and the papers and spoken to the people there?

Part of Grant Thornton’s review was to look at what the flow of information was, and who was told what and when. That is what Grant Thornton was tasked with, and it has talked very clearly about the reporting mechanisms, what was provided information-wise and what was not. We are very clear. Christine McLaughlin has looked at any information that was passed at the time and she might want to say a bit more about that.

What I was trying to get at is whether somebody has come and spoken to your people and been into your records.

To clarify, the e-health review certainly included the Scottish Government’s role as much as the roles of the other parties. That was fully included. Emails were looked at and members of staff were spoken to in relation to e-health, and the outcome of that was included in the report.

The report that has been presented and that we are discussing in relation to financial governance looked at reporting to the Scottish Government. As far as I am aware, there were no interviews with the Scottish Government. It was a look at documentation and the flow of information between NHS Tayside and the Scottish Government.

10:30  

I have a further question on another issue that has been spoken about. There has been a suggestion that you should have intervened earlier. You said that that was not possible given that neither internal nor external auditors raised significant issues with you. Following on from that, you have said that there should be an examination of why the issues were not flagged up by the auditors. Can we cut through the wishy-washy language here? Does that mean that you believe that the Auditor General’s office failed in its duty to you?

No. I would not use that language at all.

What language would you use?

There are lessons to be learned from all parts of the system. If we are going to make improvements, we all have to take a hard look at what could have been done better.

I would contend—and I am sure that Alex Neil would contend this as well—that had any part of the system, whether that was internal or external audit, escalated the specific matter to Alex Neil’s attention or indeed to my attention when I came into post at the end of 2014, action would have been taken. You can be assured of that. We need to make sure that the processes of internal and external audit would do that in future, and that means that we all have lessons to learn.

Do you believe that they should have done it in the past? That is the question.

Of course, and that is why lessons need to be learned. If that had happened, we would have looked at the issue in 2014, rather than looking at it in 2018.

I am looking for a bit of clarity in relation to Willie Coffey’s question about repayment of the endowment funds, which I know you are keen to see. Did you say that £3.6 million will be transferred back to the endowment fund account in NHS Tayside?

Yes.

When should we expect that to happen?

It will be during 2018-19, so it will be during the current financial year.

Can we expect to see that back in the accounts at the year end?

Yes.

The original report that Helen McArdle wrote in The Herald said that more than £4 million had been approved for transfer from the endowment fund to the core funding budget. Have you done investigations to see whether that amount was transferred, and therefore the difference—I cannot remember exactly; were the amounts £4.2 million and £3.6 million? Was that amount transferred and, therefore, is there still money that needs to be paid back? Is it going to be more than £3.6 million?

No. Grant Thornton specifically looked at what was transferred, and it was £3.6 million. I do not know where The Herald got its figure from, but the independent report identified £3.6 million, and that is an accurate reflection of what needs to be paid back.

Your office received the Grant Thornton report that we have been talking about today a week before the committee received it. What has happened to it during that week?

We have been going through the normal process to get it to a final draft. I think I said to you that we were expecting the first draft on Tuesday of last week, and we got a final draft on Friday. It was just a routine process of making sure that it was complete. There were gaps in it when it first came out, which Grant Thornton was continuing to finalise, and it was making sure that it had verified everything that it needed to verify. We had the final draft on Friday and it was ready for clearance internally on Monday of this week.

So it has been changed.

There was not a complete draft until Friday of last week. I would not say that it has been changed; it is just that it was not complete.

As Christine McLaughlin said, Grant Thornton had additional bits of information to put into the report, which the final report contains.

Is there any way that the original report that you received can be made available?

I can speak to Grant Thornton and see. There is a normal process by which somebody will say, “This is the draft version that we will release.” I will speak to Grant Thornton and ask it to give you that.

Okay. Of the six reports on NHS Tayside, one is a statutory report, which is the one from OSCR. Given that it is a statutory report, what is your understanding of the process around it? Will it also come to you in draft form or will it be published directly by OSCR and made available to the committee and the public?

It is OSCR’s report.

We have no locus whatsoever on that report. It will not come to the Scottish Government. It will be an entirely independent report from OSCR, which has a protocol—

We did not commission the report, so—

Sorry. One at a time, please.

OSCR has a protocol, which is published, that explains how it undertakes reviews and its process for publication of reviews. There will be no draft report to the Scottish Government or anything of that nature.

So we will receive the first report. The process is different from the process for the Grant Thornton report.

That is correct.

That is because we commissioned Grant Thornton to do the work. OSCR decided to do its own review.

But you will check for us whether we can have the original version of the Grant Thornton report.

Yes. I will clarify that.

Great. Do members have any further questions?

Whoever put pressure on the internal auditor to change the report, that is a fairly serious disciplinary issue. Has appropriate action been taken?

As I said earlier, Grant Thornton goes on to say that it has been unable to substantiate the allegations, but it does point to the changes in reports. However, the individuals involved, as we have talked about throughout this morning’s session, have retired. Indeed, one, who was the chair at the time, is deceased. Christine McLaughlin has taken action in relation to professional organisations—

As in the case of anyone who is professionally qualified, it would be for professional bodies to look at individuals’ actions and decide whether there is any action to be taken. At the end of the process, there will be a discussion. I have had initial discussions with some of the accountancy bodies in relation to the events and I know that they are taking a very close interest in the outcome and will determine whether there is any follow-up to be done or any reviews that they wish to hold in relation to members of any of their accountancy bodies.

A very clear message has to go out to everyone else in the public sector that that is not on.

Exactly.

Thank you all very much indeed for your evidence this morning.

10:37 Meeting continued in private until 11:19.