Public Audit and Post-legislative Scrutiny Committee 19 April 2018
The agenda for the day:
Decision on Taking Business in Private, “The 2016/17 audit of NHS Tayside: Financial sustainability”, “Managing the implementation of the Scotland Acts”.
Decision on Taking Business in Private
Decision on Taking Business in Private
Good morning and welcome to the ninth meeting in 2018 of the Public Audit and Post-legislative Scrutiny Committee. I ask everyone in the public gallery to switch off or switch to silent mode their electronic devices, please, so that they do not affect the committee’s work.
Agenda item 1 is a decision on whether to take items 4, 5 and 6 in private. Do members agree to do so?
Members indicated agreement.
“The 2016/17 audit of NHS Tayside: Financial sustainability”
“The 2016/17 audit of NHS Tayside: Financial sustainability”
Agenda item 2 is an evidence-taking session on the 2016-17 audit of NHS Tayside. I welcome our first panel of witnesses: Caroline Gardner, the Auditor General for Scotland; and, from Audit Scotland, Fiona Mitchell-Knight, assistant director of audit; Claire Sweeney, associate director; and Bruce Crosbie, senior audit manager.
I invite Colin Beattie to open the questioning.
Auditor General, in the past, I have raised the question of the capability and the appropriateness of internal audit in its present form. We seem to have another problem with internal audit. There is a history of such problems. We have had issues at NHS Grampian, NHS 24, Coatbridge College and Edinburgh College, where internal audit, although it seems to do its job, does not pick up what is necessary. Now we have the situation at NHS Tayside. Is there a problem here?
Caroline Gardner (Auditor General for Scotland)
I think that, in this case, it is premature to conclude that the problem is with internal audit. The evidence that is available to us so far—clearly, the investigation is still under way—is that internal audit raised concerns about the retrospective transaction on the endowment fund, which is what I assume that you are referring to, and that those concerns were not acted on by the trustees of the fund at the time.
We know that the Scottish Government has asked Grant Thornton to continue its investigative work to look at the transaction, following on from its work on e-health funds that you took evidence on before the Easter break, and I would prefer not to comment on the role of internal audit until then. However, it is clear that there was a breakdown in the governance more generally, and I am looking to see what advice the trustees took before taking a decision about the use of endowment funds back in 2014 before I draw any conclusions about that.
It is clearly not just a question of the endowment funds; the situation with the e-health funds raises questions about internal audit. For example, when Lesley McLay appeared before the committee as a witness, she said that she was not aware that the e-health funds were within the deferred expenditure and that she had not asked about that
“Because there was never any risk identified to me or to the board.”
She went on to say:
“We rely on internal audit to review our allocations, and there was never any risk identified that there were inappropriate allocations coming into our board.”—[Official Report, Public Audit and Post-legislative Scrutiny Committee, 29 March 2018; c 26.]
Was her expectation reasonable? Should she have expected internal audit to be able to alert the board?
Lesley McLay’s expectation was clearly reasonable. I am pausing before drawing the same conclusion that you are because the Grant Thornton review makes it clear that the allocation letters, which go from the Scottish Government to each health board with the allocations, did not make it clear that the funds were either ring fenced for e-health purposes or were repayable in the following year. Without that clarity, it is difficult to see how internal audit could have raised the matter as a risk, or how the board members could have known.
The Grant Thornton report makes it clear that the former director of finance was aware of the issue, as was the director of finance of NHS National Services Scotland, which arranged for the allocation changes to go through, but that the conditions on the allocation for e-health moneys were not clear on the allocation letters, which would be the basis on which internal and external audit would look at the matter to make sure that the revenue recognition was accurate in the annual audit of the financial statements.
Are you aware of whether internal audit reviewed how the deferred expenditure account was made up and what its component parts or contents were?
I invite Fiona Mitchell-Knight or Bruce Crosbie to pick up that question.
Fiona Mitchell-Knight (Audit Scotland)
From an external audit perspective, there are two issues with the deferred expenditure: the accounting and the financial sustainability. From the accounting perspective, the deferred expenditure is included in the board’s income in an appropriate way and in compliance with the accounting rules. We are satisfied that that was the case in 2016-17, which is the period that we have carried out the audit on.
The bigger issue is what that means for the financial sustainability of the board, because it was relying on non-recurring funds. Both Audit Scotland and internal audit have reported on the risks that such reliance brings to the board—indeed, those risks were identified in the Auditor General’s report to you that was discussed in October.
On the endowment question, do the internal auditors receive copies of the board minutes?
Do you mean the board minutes or the fund minutes?
They would certainly receive the board minutes; I assume that they would receive the fund minutes, but I ask Bruce Crosbie to confirm that for you.
Bruce Crosbie (Audit Scotland)
Yes, our understanding is that they receive the fund minutes, too.
So the internal auditors would have received the minutes of the meetings at which the endowment issue was discussed and at which the action was taken that we are now aware of. Would it not have been reasonable for them to have read those minutes and said that what was happening was a problem?
Our understanding is that the internal auditors raised their concerns about the retrospective transaction back in 2014. The matter is also included in the external auditors’ report—both in the body of the report and in the executive summary—so the concerns have been in the public domain for some time.
The question that is of concern to us is the advice that the trustees of the fund took before approving the transaction, but there was disclosure in the annual audit report and—as a result, I think, of the internal auditors’ involvement—in the governance statement of the board’s annual report itself.
I am struggling with the concept that this has all been in the public arena but no one has picked it up. You say that the internal auditors raised the matter as an issue. I presume that they raised it with the board. Therefore, the board was part of the problem, if you like. How does this work?
That is a very good question. As you say, the matter was raised in 2014 by internal audit and external audit. I have reported on the financial pressures on and the financial sustainability of NHS Tayside to this committee each year for the past three years—2014-15, 2015-16 and 2016-17. In my annual overview reports, I have highlighted the perverse incentives and the narrow focus that health boards are taking to land on their revenue resource limits each year instead of looking at their broader sustainability. There is a significant question about why warnings from auditors are not being taken seriously throughout the national health service system. You would need to ask people in the Scottish Government and the board why that is the case.
The external auditors presumably look at all the reports and so on from internal audit; I presume that they work closely together. What did the external auditors do when saw the transaction?
First of all, it is important for me to be clear that the external auditors do not audit the endowment fund. The fund appoints its own auditors, who are not within my remit as Auditor General.
Can I interrupt on that point? There was evidence of a concern from internal audit. Surely the external auditors would have picked that up and developed it.
They did. I am starting off by clarifying the formal responsibilities. I appoint an auditor to the board. The endowment fund appoints its own auditors.
Since 2014, the accounts of the endowment fund have been consolidated within those of the NHS board because of—to put it in lay terms—the degree of overlap between them. You are probably aware that the trustees of the endowment fund are the members of the health board, who are appointed by the Cabinet Secretary for Health and Sport. They are the same people, sitting in a different capacity. To carry out that consolidation, the auditor of the health board issues a questionnaire and instructions to the auditor of the fund, which ask them for a number of pieces of information about the board minutes, the significant transactions that were made and any unusual transactions.
As a result of that, the auditor of the health board included in their annual report for 2014 a clear statement about the retrospective transaction and the extent to which the board had relied on transfers from the endowment fund during 2014 to balance its books. That was the first year in recent times that NHS Tayside had required brokerage and that was part of the same picture. However, because the auditor of the health board is not the auditor of the endowment fund, it is not their responsibility—and, indeed, they have no locus—to examine the advice that the endowment fund took before approving that transaction. That is a matter for the auditors of the endowment fund and, indeed, the fund’s trustees, who have specific responsibilities under the charities regulations for acting in the fund’s best interests. I understand that the review that the Office of the Scottish Charity Regulator is currently carrying out will explore that.
I realise that the endowment fund does not fall within the audit programme. However, internal audit raised the issue. You say that external audit picked that up and took action on it, but the problem just seems to have popped out recently even though it has supposedly been in the public arena for some years.
There is no “supposedly” about it. I have the annual audit report here. It has been on our website and NHS Tayside’s website since June 2014 and the matter is clearly reported in there. The issue that has arisen now is whether the members of the board were acting properly as trustees of the endowment fund in approving that transaction, what advice they took and whether they were aware of the concerns that I understand that internal audit had raised. As far as I know, there is at this point no concern that the transfer was illegal. It was a regular transaction and the auditor reported it in that way as an unusual transaction that played into the growing picture of financial pressures at NHS Tayside.
Everybody claims that they did their job, yet we are where we are. Is the audit function broken? Should the way in which we handle internal audit, and perhaps even aspects of external audit, be reviewed?
You will not be surprised to hear my view that this is not about the effectiveness of audit. The matter was reported in the external audit report. Internal audit raised concerns. The question is why the trustees of the endowment fund did not respond to those concerns when they were reported. OSCR is considering that.
For me, the issue that is raised is whether there is an inherent conflict of interests in the fact that the trustees of the endowment fund are the same people as the members of the NHS board. The Scottish Government considered that back in 2013 when it produced its guidance for endowment funds and concluded that there was no inherent conflict of interests. That question is now back in play, given what we have seen in Tayside and the concerns that are being raised. The question is whether, particularly when health boards are under financial pressure, trustees are able to separate their responsibilities as trustees from those as members of the health board.
That is a fair question, which I hope that OSCR will address in its report.
At the beginning of my questions, I gave a list of occasions on which I believe that there have been failures in the audit system—times when problems arose that audit did not pick up because that was not part of the process or for some other reason. Is audit a chocolate fireguard?09:15
Not at all. It is important to be clear what audit does. It does not substitute for the responsibilities of management and board members who are charged with governance in making sure that they have proper checks and balances in place, and that they follow the corporate governance requirements and comply with the Nolan principles. External audit provides a way of reviewing the extent to which those checks and balances are being applied and reporting that to the appropriate body. In the case of the bodies in my remit, the appropriate body is this committee, which is why we have been discussing the matter.
Auditors do not have stop powers—they cannot stop people doing things that they think are inappropriate. The power that we have is that of public transparency and exposure, and the fact that we are discussing these things is a marker of the system working, not of it being broken.
I have one last question. Given the scale of the financial issues that we are facing at NHS Tayside, are you satisfied that at no point was any undue pressure put on the internal auditors to go easy on any of their audit processes?
I cannot give you that assurance. I know that internal audit raised some concerns and that, in the case of the endowment fund transaction, those concerns were not listened to. I do not know what pressure might have been applied, but I think that it is a worthwhile question to ask.
To follow up on Colin Beattie’s line of questioning, the issue to do with the endowment funds came to light in a story in The Herald written by Helen McArdle. She said:
“internal auditors from NHS Fife and Forth Valley questioned how endowment fund cash was being used, but were warned they risked losing their contract with NHS Tayside unless they backed off.”
What is your reaction to that?
I have seen the press coverage. It obviously informed my response to Mr Beattie’s question. I do not have evidence either way of whether the internal auditors were put under pressure. I expect that that is one of the issues that the second phase of the Grant Thornton review will explore. It is worth noting that it relates to one of the differences between internal and external audit, certainly in the Scottish public audit system. Internal auditors are appointed by or are part of the body to which they provide services. External auditors are appointed by me to bodies in the health service and the other bodies for which I have responsibility, which means that that sort of pressure cannot be applied in the external audit world in the same way that it potentially could be in internal audit. That is an important distinction.
If what I read out was true, I take it that you would see that as unacceptable.
Completely. Internal audit is there to provide assurance to those who are charged with governance. It is intended to have a degree of independence to report directly to the audit committee, not simply through the chief executive. Although there is always a discussion about the factual accuracy of an issue, at the end of the day it is for the auditor, internal or external, to make their judgment and to report it without fear or favour.
I would like to follow up on some of Mr Beattie’s other questioning. In your opinion, did the trustees of the endowment fund at NHS Tayside comply with the Nolan principles at the meeting in 2014 at which they suspended the constitution?
It is premature to conclude that they did not. I know that a lot of concern has been raised publicly about the fact that the funds were spent on a computer system. If we step back and look at the purposes and charitable objectives of all the endowment funds, they are quite broadly drawn. They are about providing support for health services and they are very close to the objectives of the NHS in the same legislation—the National Health Service (Scotland) Act 1978. The guidance that was produced in 2013 by the Scottish Government added a proviso that said that trustees should be careful that they are not substituting for core health services, and that clearly comes into play in what we currently know about the retrospective expenditure on information technology systems. The other concern that I have is that it was retrospective, rather than being part of a planned programme of expenditure of endowment fund moneys.
The review that OSCR is carrying out will look at whether, for example, the trustees took their own legal advice, separate from that of the board, about the use of funds for that purpose, and at the question that we have explored about whether they took advice from their internal auditors in the way that I would expect them to.
I do not think that any of us is clear on when OSCR is expected to report. Do you know?
We have a letter from David Robb. I will ask one of my colleagues to check whether it contains a date. It probably does not have an explicit target date.
If it is the same letter that the committee has, I do not think that it has a date. Perhaps we can check that after the meeting.
You said that it is now an open question whether endowment fund trustees should be the same people as board members, who are under pressure to reduce a deficit or balance the books. As Auditor General, is it your opinion that there should be a separation between endowment fund trustees and board members on health boards?
That is a matter for OSCR and for the Government, but my view is that this case shows the risks of having a set of individuals working in two separate capacities at the same time. It is easy to agree in theory with the conclusion that was reached in the Government’s 2013 guidance that, with proper processes, there need be no conflict, but when we are in a situation where all boards are under significant financial pressure, it is difficult to maintain that separation in practice.
Is that 2013 guidance good enough? Some trustees tell me that, when they are presented with decisions on whether something is charitable spending or core funding, it is sometimes difficult to make that call. Is the 2013 guidance strong enough?
I completely agree with trustees that it is hard to make that call. As I said, the charitable purpose and objectives of endowment funds are, in many ways, exactly the same as the objectives of the NHS. Endowment funds are not only for the extras or patient comforts or the sorts of things that people might assume that they are for. For example, it is common for people to make a donation for a specific piece of medical equipment such as a magnetic resonance imaging scanner. It is not an easy separation to make, which is another reason why it might be worth reconsidering whether trustees should be different people from board members, or at least whether there should be an independent element in the make-up of the fund’s board of trustees.
Correct me if I am wrong, but I understand from press coverage that £4.3 million was transferred from the endowment fund to NHS core funding but £2.71 million was spent. The cabinet secretary and the new chair of NHS Tayside have said that the endowment funds will be paid back. How much money would you expect to be paid back—the £4.3 million that has been transferred or the £2.71 million that was spent?
In 2014, the amount that was funded retrospectively on projects that Tayside health board had commenced was the £2.7 million. During the year, the amount transferred was larger, and I do not know how much of that was spent or not.
It is worth being clear that we have been closely following events in Tayside, including the board meeting last week, in which the board agreed to repay the money to the endowment fund. As the auditor of the board, Fiona Mitchell-Knight has asked it for a range of information, including the legal advice that it has taken on its ability to make that transfer from health service funding to the endowment fund, the specific statutes that it is relying on and its process, including the paper that the board considered and the minute that it has taken. We are still considering how that transaction can be made in a way that fits with the board’s powers and responsibilities.
I am not 100 per cent clear on that. If the £4.3 million has been taken from the charitable fund and put into NHS core funding, the people who have raised that money and given so generously would probably expect the £4.3 million, and not just the amount that has been spent, to be returned. Is that what you are saying should be transferred back?
That is why we want to see the board paper that was considered and the legal advice that the board took in considering that decision. At the moment, we do not know the answer. Fiona Mitchell-Knight and Bruce Crosbie were not at the board meeting last week. We have not yet seen the board agenda paper, which explored the proper course of action for board members to take, or the minute of the meeting.
Okay—we can come back to that.
Last week, we looked in some detail at the undetected e-health funds—the £5.3 million that was “obscured”, to use Paul Gray’s language, in the accounts. Lesley McLay stated that she was not aware of it and the former chair, Professor Connell, said that the £5.3 million had been broken down into chunks that were almost de minimis, so they would not be picked up. Would you expect a higher level of scrutiny by either the management team or the board in those circumstances?
I would expect two things that seem not to have happened here. The first is for the allocation letters that go from the Scottish Government to the health board to be clear about the purpose of the funds that are being transferred and any conditions that are attached to them, including whether they are intended for the benefit of boards other than simply NHS Tayside and whether they are due to be repaid in the following financial year.
Secondly, I would expect the director of finance, who holds a significant and responsible position within the corporate governance of the board, to make that clear to the management team and the board as part of the financial reporting. On the basis of the report that Grant Thornton has produced, neither of those things seems to have happened.
I will come back to the director of finance shortly, if I may. We heard quite a lot of evidence about how difficult it might have been to pick up those funds in the accounts. Will you make clear whether the management team and the board should have detected the funds? Would it have been possible for a management team and board to do that?
I think that it would have been hard to do, given the lack of detail and information in the allocation letters. I ask Fiona Mitchell-Knight or Bruce Crosbie to tell you more about what they see as they carry out the audit, given that revenue recognition is one of the significant risks that any auditor has to look at as part of their work.
The accounting rules on income for boards say that the income that is included in the boards’ accounts should agree with what is seen in the Scottish Government funding allocation letters, so those letters are our prime source of evidence for looking at what income should be included in the accounts.
For the 2016-17 audit, we checked those letters and found that they do not say anything about any of the funds not belonging to Tayside, and nor do they mention any requirement for the funds to be repaid. There was no way that we could identify from those specific letters that that was the case, and nor could we expect the members of the board or management team to identify that.
Of course, we were not aware of the discussions that were on-going behind the scenes between the directors of finance and the e-health group, which are discussed in the Grant Thornton report. We had not seen any of those emails or any other evidence that would lead us to question anything in the allocation letters.
Was the drafting of the allocation letters unusual, or is this a structural failing that needs to be rectified?
I think that it is a structural failing. In my annual overview reports across the NHS since 2012, when I took up this job, I have reported on the narrow focus that boards have on hitting their financial targets on 31 March. There are an awful lot of changes to the allocations that boards get during the year—and indeed after the end of the financial year—for different purposes, so there is an underlying concern that it is not easy for boards to know how much they have to spend, potentially until after the financial year end.
In this particular case, we know from the Grant Thornton report that it suited both NHS National Services Scotland and NHS Tayside for allocations to be moving in that way. The directors of finance of both bodies appear to have been aware of that, because it removed a surplus from NSS and helped to reduce NHS Tayside’s deficit. However, because of shortcomings in the way that the allocations were managed, that was not apparent to anybody else, except the directors of finance in those organisations and potentially a small number of more junior team members.
Might a differently constituted board have picked up the issue? For example, the board of NHS Grampian seems to be performing rather well, which is one of the reasons why we have some changes going on at NHS Tayside. Might a high-performing board such as NHS Grampian have picked up this sort of thing?09:30
As Fiona Mitchell-Knight said, it would be very difficult for any board to do that if it was being misled by its director of finance. Directors of finance hold a significant responsibility. They have professional and ethical responsibilities by merit of being members of their professional accounting bodies. They have personal responsibilities in relation to the corporate governance code and the financial reporting manual. If they are not making that information available to board or management team members, it is difficult to see how the board can be expected to overcome that.
I am going to recite the narratives that I am hearing and that I heard last week. You have just talked about the board being “misled” by the director of finance, and Paul Gray talked about “deliberate obscuring”. The narrative that I am getting does not quite make sense. The then director of finance was long-serving—he had been there for about 35 years—very senior and experienced, and very close to retirement, and yet, without referral to his colleagues, including a chief executive officer and former chief operating officer with whom he had worked for a long time, he apparently deliberately obscured that transaction. It is a process from which he derives no financial benefit and that delivers no benefit to NHS Tayside, because we heard from Paul Gray that brokerage would have been extended and there would not have been a problem with that, so nothing is apparently achieved. Effectively, the FD goes rogue for no reason. Is that credible?
I cannot speak about the motives or rationale for the director of finance’s behaviour. All I can go on is what is in the public domain, both in relation to the e-health moneys over the past few weeks and going back to 2013-14, when auditors first started—in the time that I have been in this role—to raise significant concerns about the financial pressure that NHS Tayside was under. NHS Tayside first received brokerage in 2013-14. That is not terribly unusual—a number of boards require brokerage from time to time—but, since 2013-14, NHS Tayside has needed and received brokerage every year. More than most boards, it has been resorting to short-term measures to bring its budget into balance at the end of each financial year.
It is important to be clear that, as I have said in my overview reports every year since I have been in this job, in my opinion, the fact that NHS boards take very seriously the need to balance their budget almost to the penny at the end of March each year gets in the way of more strategic and important longer-term financial planning that would help to address the underlying causes of some of those pressures. I think that that climate, rather than any sense of personal gain, may help to explain the actions of the director of finance. It is about the premium or focus that is placed by the Scottish Government, and more generally in the public debate about health boards, on health boards balancing their books rather than having a sustainable financial strategy for the longer term.
I appreciate that it is a difficult question to answer, but is it credible that the director of finance did all of that and did not at any stage say to anyone else in the organisation, “This is what I am doing to achieve the end game that we require.” Is that credible?
That is a very broad question. Again, it is difficult for me to comment on people’s motivations or what may have been known. We know that it would have been very hard for members of the management team or board to have been aware of what was going on with the e-health funds. Revenue recognition is one of the key risks that auditors plan their audit work around each year—they look for evidence to ensure that the income is properly stated in the accounts.
For five years now, individual auditors—and I, at a national level—have been reporting the measures that people right across Scotland take to balance their books, such as by deferring expenditure, making non-recurring savings and, from the Scottish Government’s point of view, redistributing money through late allocations to bring boards into balance. All that means that it is possible that the way in which a relatively small amount of money—let us not forget that, in 2016-17 the amount of e-health funding involved was £2.6 million—may not have been apparent to more senior people in the organisation. I do not know whether people who were more junior in the finance team knew about it, but I suspect that they may not have understood its significance or have had the whole picture so as to be able to see it in that way.
Auditor General, you have referred to the behaviour of the former director of finance. Do you have any evidence that he did not share the information about the e-health deferred funds, apart from what we heard from Paul Gray and Lesley McLay at the previous committee meeting?
The evidence that I am founding on is the report that was commissioned from Grant Thornton to explore the specific issue of e-health funding, in which it explicitly reached that conclusion.
Did it reach the conclusion that the director of finance had not shared that information?
I think that the way that it phrases it was that it would have been very difficult to see how other members of the board could have been aware of it. Again, that report is available to the committee.
The committee is clearly concerned to know whether the problem is one of the behaviour of particular individuals in NHS Tayside or particular elements of governance, internal audit, the board’s audit committee or the finance director, as Mr Kerr asked about. Does the problem relate to NHS Tayside or to the wider NHS system? Is it fair and reasonable to say that, in your previous answer, you suggested that what happened was not an attempt at personal gain by anybody but perhaps an act of desperation to make a budget look as though it had been balanced when, in fact, it was not possible to do so?
Yes, I am very clear that there is no question of personal gain. It is difficult to understand the issue without understanding the context of general pressure and concern about delivering a balanced budget in each health board across Scotland. There was a situation, which had been building since at least 2013-14, of that being increasingly difficult to do. If we set that alongside what we now know are shortcomings in the process by which the Scottish Government allocates resources to individual boards, my sense, which is informed by the Grant Thornton report, is that the director of finance at NHS Tayside was able to use that to make the position appear better than it was.
As you have done previously, you spoke about measures to balance the books in order to meet the short-term requirement to balance funds across boards and across Scotland. Is it true that the pressures that we can perhaps surmise have led to the behaviour in NHS Tayside are prevalent in other boards across Scotland?
I have been reporting on that since I took this job. In 2012-13, which was the first year for which I had responsibility, almost no boards—I will not say that it was none—failed to meet their resource limit targets, but that was done at the cost of an awful lot of short-term measures, such as deferring expenditure, making late allocations and finding non-recurring savings, which gave the appearance of a balanced budget but did not address the underlying problems.
Earlier, in response to Mr Beattie, you said that, throughout the system, auditors’ warnings are not being taken seriously. By that, did you mean across the NHS throughout Scotland?
I meant two things specifically. One is that, in NHS Tayside, such warnings have been sounded very clearly since 2013-14. In relation to the system as a whole, since I took up this role in 2012, I have been saying that about the pressures on the NHS beyond that. The overview reports contain information about the measures that are being taken in other boards, but I would prefer not to be specific about those without referring to the factual content of the reports.
Is it fair to say that NHS Tayside is the canary in the coal mine? Is it the place in which such pressures have led to the problems that we have seen and are now dealing with, and that the Cabinet Secretary for Health and Sport has had to deal with by using her special powers? Is it an indication of problems that could arise elsewhere?
It is not straightforward to draw that direct line of conclusion between the two. There are particular circumstances in Tayside that have made the pressures on the board more acute—the committee has taken evidence on that on a number of occasions over the past couple of years. They are to do with NHS Tayside’s expenditure on drugs and agency staff and the property portfolio that it holds. Equally, over the past five years, I have reported on the extent to which most boards are relying on short-term measures to balance their books.
The e-health money and the endowment fund are two separate issues and there are two separate sets of circumstances. What happened with the e-health money appears to be a result of the deal that was done between the finance director of NSS and the finance director of the Tayside health board, neither of whom was going to gain personally. The deal was done to try to shore up the appearance of robustness in the Tayside health board budget, and it solved a problem for NSS because it did not appear with a big surplus at the end of the financial year.
Are you sure that similar deals on e-health money or anything else with a similar impact of covering up what is going on in the health service’s financial system have not been done between NSS and other territorial boards—or, indeed, between any of the other non-territorial boards and a territorial board? Having been a health secretary and knowing how those bureaucracies work, I find it hard to believe that it was a one-off deal.
At this stage, I cannot give you that assurance. As you can imagine, the auditor of NSS will look closely at the other special-purpose funds that it manages and distributes, and the auditor of the Scottish Government will examine the way in which the health directorate looks to improve the allocations process and understand what might have happened under the process as it stands.
However, the issue is part of the wider question about the pressure to meet short-term targets rather than manage long-term sustainability. I would like the Scottish Government and individual health boards to shift the focus away from how much they need to save to hit their revenue limits on 31 March towards asking whether they understand their finances over the next five or 10 years and what measures they are taking to ensure that they are sustainable.
When, roughly, will that work be complete? When will the committee know whether there were any similar deals, possibly covering other territorial and non-territorial boards, possibly covering issues other than e-health and possibly including other e-health deals?
The NHS director of finance is carrying out her own review as a matter of urgency to consider those other funding streams and how the allocations process can be tightened. We will pick up the issue as part of the annual audit for 2017-18 for all the boards for which I am responsible. Those audits are due to be completed by 30 June. There is obviously a bit of interplay between those two processes.
Whether similar deals have been done across the board is a specific issue. It seems to me inevitable that other deals will have been done that have not come to light so far. As a former health secretary, I do not believe that the Tayside deal was a one-off.
As I said, I have reported over a number of years that late allocations have been used for purposes that appear to have the primary rationale of levelling out underspends and overspends between boards. We know that it has happened. The question that now needs to be answered is slightly more difficult: whether there are any hidden streams of funding that are small in relative terms but significant in absolute terms. Uncovering those might take a little bit longer, but we as auditors and the NHS director of finance are looking at that as a matter of urgency.
You mentioned the auditors of NSS and the Scottish Government. Will you say who they are?
As you know, I appoint the auditors to all the NHS bodies. In the case of the Scottish Government, I sign the account myself and I appoint a lead auditor to undertake the work on my behalf. NSS is also audited by an assistant director from Audit Scotland, who is the same person who leads the Scottish Government audit, so there is a good degree of interaction.09:45
I want to go back to the interim arrangements at NHS Tayside. First, I have the highest regard for Malcolm Wright, who is one of the best officials that I came across anywhere in Government. I have total confidence in him as a very competent individual. However, he is chief executive of the northern region of the national health service; he is also chief executive of NHS Grampian, which is not without its own difficulties; and he has now been appointed as acting chief executive of NHS Tayside. How on earth will he have any time to deal with the problems in Tayside when he is holding down three very important jobs simultaneously?
I share your concern, Mr Neil. As I have, you will have seen the information in Paul Gray’s letter about the arrangements that are in place for the deputy chief executive at NHS Grampian to take on additional responsibilities in that board to free up some time for Malcolm Wright to focus on NHS Tayside. However, none of those are small, part-time jobs that would leave lots of time and energy for other things. I assume that the Scottish Government is quickly looking to resolve the question of the long-term leadership of NHS Tayside, which is a question that you would need to address to the Government.
What is the definition of “quickly”? I have concerns about this. I think that the job requires somebody who has no other responsibilities in any other organisation. The chief executive is the key person to sort out governance, yet that is not a clever governance arrangement. In fact, it is very high risk.
I share your regard for Malcolm Wright and your concerns about the stretch that that would place on any individual, however competent and experienced.
Secondly, on the other interim arrangements, what is the current status of the former chief executive?
My understanding is that Ms McLay is currently off sick.
Was she off sick before she was told to stand down?
Those are questions that you would need to direct to the Scottish Government.
My concern is that, yet again—we have been through this with the Scottish Police Authority, big time—we have a chief executive who has been told to stand down and who, it would appear, has then gone off sick, getting their full salary, presumably. The issue of severance payments and all the rest of it also comes up. From an audit and governance point of view, are you not concerned about that very unclear arrangement?
I do not know the timeline of actions and events surrounding Ms McLay over the past few weeks, since the issues have been in the public domain.
It is important to say that, as the appointed auditor, Fiona Mitchell-Knight will be looking in the course of her audit work at any severance payments that come up as a result of that. We know that the former director of finance has departed, and Fiona will be looking closely at the decision making and any financial transactions around that. That will also be the case if Ms McLay leaves the board. Any auditor would want to comment on significant changes and, potentially, significant gaps in the governance arrangements for the body that they audit.
Without knowing more about the particular circumstances, and recognising the sensitivity of that employment issue, I cannot say much more this morning, but it will be an important matter for the auditors to look at.
There is another, related point in relation to the former chief executive. When she became chief executive, she was appointed as a director of the board. Has she resigned or been dismissed as a director of the board, as that is a separate process?
My understanding is that she would be a member of the board as the chief executive, and I have not seen anything to suggest that she has been removed as a member of the board. It comes down to very explicitly understanding what her status is. My understanding is that she is on sick leave, but that is really a question for either the chair of the board or the Scottish Government.
We need to check the current situation. When I was the cabinet secretary, I changed the rules. The irony was that the cabinet secretary had to approve the appointment of every board member except the chief executive, over whom, at that time, the cabinet secretary had no responsibility. I changed that position because an appointment was made on one board with which I strongly disagreed. I had indicated previously that I would strongly disagree with the appointment, but the board and the chair went ahead and made the appointment anyway. They then asked me to sign off that person becoming a director, and I refused to do so until we changed the rules.
We changed the rules because the chief executive appointment is the most important of all appointments, yet it was the one in which the cabinet secretary had absolutely no involvement. We changed the rules so that the cabinet secretary had to approve the appointment of the chief executive but that was a separate legal process from making the appointed chief executive a member of the board.
We need absolute clarification from Paul Gray on all these points. I do not want us to be in a position yet again in which a chief executive is told to stand down because of the governance situation but they are able to stay on full salary for a year before they leave the organisation. I do not want to get into personal issues; it is a governance issue and I am addressing it as such. However, on all these questions, we need immediate clarification from Paul Gray.
We will seek that clarification from Paul Gray. We can discuss that after this evidence session.
Auditor General, I will follow up on one of the questions. For many years—from well before my time on it—the committee has been concerned about severance payments in the public sector, which Alex Neil touched on. We know about the financial mismanagement at NHS Tayside, and you have reported on it for many years in section 22 reports. In your opinion, should the outgoing chief executive receive a severance payment?
It would be difficult to justify a severance payment in the terms that I think you are intending, convener. However, the committee heard in evidence from the former chair and the chief executive of the board before the Easter recess that no severance payment was involved. Instead, the former director of finance chose to exercise his option to retire, given his age and his standing with the board. That is very much the territory that Fiona Mitchell-Knight and Bruce Crosbie will be exploring as part of their audit work, in order to understand the basis on which he left and the basis on which any payments were made. You have my assurance that we will report that information as part of the reporting on the audit, which is due to be completed by the end of June.
With respect, that is about the director of finance. The current situation is that we have a chief executive who we expect will leave the organisation—the cabinet secretary said that her position was untenable and she has been replaced, but she is still an employee. Given the concerns about the use of public money on severance payments in the public sector, would it be appropriate for an outgoing chief executive to receive a severance payment from the public purse?
It is always very difficult to comment on specific cases because there are disciplinary and other potential implications to be considered, as well as employment law to be taken into account. I expect the board to look at the process that it goes through in deciding how to give effect to the request that the cabinet secretary has made in relation to the chief executive, and that is what Fiona Mitchell-Knight will be doing as the auditor.
There are clearly questions that—as far as I know—have not yet been answered. Once those questions have been answered, that will lead to the question of whether any severance payment is appropriate and how it should be made. What I can do is to bring full transparency to what has happened and report to the committee any concerns that I have about the way in which things have been done, as I have done on a number of occasions.
I will ask a few questions that have not yet been asked about the £5.3 million of e-health funding. Do we know whether that was receipted as a single payment initially or whether it was received as separate payments?
It was certainly not a single payment and it was not a payment for e-health. It was an allocation from the Scottish Government to NHS Tayside that did not make clear what it was for or the conditions that were attached to it.
It came in in smaller amounts. There was not a single £5.3 million transaction.
My recollection is that it was split across four different transactions for 2016-17. The full £5.3 million did not come in at once; it was split up.
It came in in smaller chunks initially.
Through the allocation letters—yes. It was split.
Would it still have been described as the same thing? Would the terminology or language in the allocation letters have described it as—
They did not describe it as anything. I think that that is the problem. It was simply described as an allocation of money to NHS Tayside rather than as e-health funding.
I think that e-health was in the description, but there was no indication that it was not e-health funding that was due to Tayside. There was no indication that it was due to other boards or that it was due to be repaid. The descriptions were not clear.
From that point on, there was a further process of splitting up the funds into even smaller units, which, in Mr Gray’s words, was a process that was “intended to obscure” the transactions. Are we talking about the amounts that were received or were they further dispersed and spread out through the year to achieve the effect that we are discussing?
The allocation letters for 2016-17 were split into four transactions, and then that money as a whole was included in the total income that was disclosed in the board’s accounts. It was not actual money in its hands; it was an allocation against which the financial outturn is assessed in order to measure whether the targets have been achieved.
I understand that. What I am trying to ask is, if it came in as four payments, did it then appear in the accounts as 10 payments? Was it further divided to bring it under the £1 million threshold, below which people were unlikely to notice it?
No. It is quite the opposite. It goes into the total income, which is the large numbers on the face of the accounts.
Why did nobody notice it? I think that £5.3 million is a significant amount of money for people not to notice.
It was £2.5 million in 2016-17, and that was part of the overall revenue income of £803.2 million. As Fiona Mitchell-Knight said, the allocation letters did not make it clear either that the funds were not specifically for Tayside or that they were liable to be repaid in the following financial year.
Okay. There has been some discussion about whether the audit process should have picked this up. What do you think? Do we need a different process? It is one thing to say to the boards, “Stop doing that”. It is another thing, surely, to ensure that it is not being done. If the audit process does not find and reveal it, what do we need to put in place to ensure that this kind of thing does not happen? Is it an extra audit process, or does some other internal action need to take place?
The root cause is the system by which the Scottish Government allocates funding to NHS boards. That is the prime source of income that they receive. It is important that boards are clear about what they are receiving, why and any conditions that are attached to it.
The events surrounding e-health funding in Tayside have demonstrated shortcomings in that process. That is very clear from the Grant Thornton report. We know that the NHS director of finance is reviewing that process, and we will look closely as part of our audit of the Scottish Government to see what changes it makes to the process and the extent to which they address the risks that have been identified.
Convener, do I have time to ask a question about the endowment fund?
Yes, but please be brief.
In 2010, OSCR looked at NHS Lothian’s endowment fund management, and it made some recommendations about the separation of duties between endowment fund boards and health boards. Are those guidelines or recommendations strong enough or do we need to review them given what has happened with NHS Tayside?
Claire Sweeney (Audit Scotland)
I go back to the point that the Auditor General made earlier about the need to review the guidance to see whether it is clear enough. Auditors check against the guidance to make sure that organisations are following the rules, but if there is a lot of leeway or a large degree of breadth in how they can be followed locally, it is difficult for audit teams to determine what it looks like when boards’ actions are not falling within those rules. That can happen if it is not clear from the guidance. Part of the process that is happening now is consideration of whether the guidance needs to be clearer, which will, in turn, help the audit process.
Okay. Thank you.10:00
I have some brief points of clarification. First, regarding the e-health moneys, the £5.3 million is broken down into chunks of less than £1 million. Has anyone reconciled the accounts such that the allocation letters match what was contained in the ledgers?
That is a core part of the work that the auditors do in every health board. The allocation letters are the prime source of evidence for the income that the board has to spend, which is obviously a foundation of the audit work. The problem is not that the allocation letters were wrong; it is that they did not provide that information about the money being there for more than just Tayside’s use and for it being repayable in the following financial year. That was opaque to everybody apart from the director of finance of NHS Tayside and apparently the director of finance of NHS National Services Scotland.
I will move on to something that Willie Coffey asked about. We have heard about this “deliberate obscuring”; we have heard that the funds were broken down into pots of less than £1 million so that an average board would not pick them up. However, what I just heard from Fiona Mitchell-Knight was that in fact, the sums came in and were collated into a big sum and therefore became much more obvious. Have I misunderstood something?
Let us be clear. In 2016-17, the amount involved was £2.5 million, as set out in the briefing paper that we provided. I think that Fiona Mitchell-Knight was saying that that £2.5 million needs to be seen in the context of the £803 million of overall revenue coming to the board in that year. The additional amount of money that brings the £2.5 million amount up to £5.3 million was money that the board was banking on—it was expecting to receive that money in 2017-18. It has not been part of the overall outturn yet, or indeed part of the audit that is happening.
I think that Bruce Crosbie and Fiona Mitchell-Knight are in a position to give you a bit more information about the way that the money was managed in 2016-17.
The allocation comes into the accounts through the summary of core revenue resource outturn. That starts off with the net expenditure of the health board; set against that is the amount that comes through as the gross allocation from the Scottish Government. We then identify whether the health board has met its target of achieving its revenue resource limit. That only comes into the accounts in a single sum and that is what we then check in the allocation letter from the Scottish Government. The resource accounting manual and the Scottish public finance manual require us to do that to make sure that those two are in agreement. At no stage in the accounts does it break it down to any greater detail than that, so there would be no way that we could evidence any of the amounts within that total sum to the degree that you suggest we could.
We have been concentrating on the financial impact of these decisions, but the whole point is that the e-health money was designed to carry out specific initiatives in relation to e-health, such as developing the electronic patient record and so on and so forth.
There is an important point that we have not talked about. As a result of these deals, is the ministerial policy on e-health being sabotaged in order to reach a deal to cover up a real deficit or a bigger deficit than appears to be the case? What are the implications for Government policy?
One of my frustrations when I was Cabinet Secretary for Health and Wellbeing, particularly in relation to e-health, was that I felt as though, without having an army of people to double-check that things were being delivered, in a lot of areas, things were not being delivered to the front end. Now I am beginning to understand some of the reasons why. I think that we also need to look at this from the point of view that the e-health money was designed to take forward the e-health agenda and clearly that did not happen.
You are absolutely right that that is, in many ways, the important question. It is important to be clear that the reason why the money was available to be transferred to NHS Tayside was because of slippage on the e-health programme.
It is a stretch to suggest that that is due to any attempt to sabotage the programme, but it demonstrates the difficulties in spending that money in ways that achieve the transformation of the health service, which would be one of the solutions to the financial pressures that NHS Tayside and other health boards are under.
I am not suggesting that the intention was sabotage. What I was saying was that the consequence was in effect to sabotage the programme.
It is due to slippage—there is no question of that.
Of course, we have the bizarre situation in which the e-health moneys were being used to deal with the deficit and then charity endowment money seemed to be used for an e-health project.
Auditor General, on the deferred expenditure—the e-health money—you heard me asking the former chief executive at our previous evidence session whether she should have been asking questions about deferred expenditure. Iain Gray also asked about that. In your opinion, should she have been asking those questions about what the deferred expenditure was and how much it was?
Any chief executive and any board should be asking those questions, particularly in a context in which we know that a lot of boards rely on deferred income and other short-term measures to hit their targets. Having said that, it comes back to the point that the director of finance holds a very personally responsible position and has professional and ethical responsibilities, and if the director of finance is not providing straightforward information about those questions it is difficult to know how the chief executive or the board could get beyond that, in the absence of evidence that there is a particular problem. We know from the Grant Thornton report that that evidence was not apparent.
You think that it is a two-way street. The evidence that we heard indicated that the former chief executive was under the impression that it was a one-way street: she was not given the information and, therefore, she did not know about it. In your opinion it is a two-way street: there are obligations on the director of finance to provide the information and obligations on the chief executive to ask those questions.
Absolutely. It is incumbent on any board member—chief executives and others—to ask the difficult and challenging questions. That is what they are there for.
Bill Bowman, you have been extremely patient.
Thank you, convener. My questions are for the Auditor General and Audit Scotland. If it is a different answer for either, please let me know. Are you professionally regulated?
Yes, we are. We voluntarily apply the international standards on auditing, and the audit work that is carried out, whether for the audits that I sign off or those that Audit Scotland staff sign off in their own names, is subject to all the requirements of the international standard on quality control—ISQC1—and the broader requirements that are there. We are not subject in a formal sense to review by either the Financial Reporting Council or the recognised supervisory bodies, but as of the last audit year we have voluntarily appointed one of the RSBs to oversee the audit work, in order to provide me, as Auditor General, the Accounts Commission and the board of Audit Scotland with assurance about the quality of the audit work.
I would interpret that to mean that you are self-regulating.
We are not self-regulating in that we have now appointed an arm’s-length RSB to work independently to carry out the same reviews that they do of other firms and to report them in the same ways.
But you appointed them yourselves.
So, if somebody was dissatisfied with your work in a way that, if it was a commercial audit firm, they could go to the regulator, can they go to somebody to ask them to investigate you?
They would come to me and the board, and we would provide them with the evidence that we have about the quality of the audit work. As it happens, in the first round of the audit review that was carried out by the RSB, the NHS Tayside audit was one of those that came out as a 2A grading, which means that only limited improvements are required and it meets all of the relevant professional standards.
I would still interpret that as being self-regulating. You are not statutorily regulated.
In a formal sense, yes; but we have done everything that we can to ensure that we are meeting the same standards, because I have a very strong professional commitment to the quality of the work that we do, as you would expect.
I understand that, thank you.
On the question of the audit of the endowment funds, you distanced yourself from that, but you also said that they are included in the consolidated financial statements. To me, that means that you have an audit responsibility over those funds, regardless of who did the audit. Can you just clarify that you take responsibility for those audits?
It is not quite accurate to say that I distanced myself from it. As a matter of fact, I do not audit or appoint the auditors to the endowment funds; under the charities regulations, they appoint their own auditors. It is also the case that, as I have said, since 2013, the endowment funds have been consolidated within the board accounts, and the auditors follow the requirements of the international standard on auditing—ISA 200—in doing that.
But you said that you may not have the right to get certain information.
No, I said that we do not have the same access to a body or fund that we do not audit as we do to the ones that we audit, but we—
But you must judge that that is not a limitation on your scope because there is no comment in the financial statements.
Absolutely. We apply ISA 200. Fiona Mitchell-Knight and Bruce Crosbie will be very happy to talk you through how they do that in relation to the NHS Tayside endowment fund.
Okay—thank you. I have previously asked questions—I think it was on the SPA audit—where we have a clean audit opinion on the financial statement followed by quite damning section 22 reports. This week in the chamber, the cabinet secretary referred to the financial statements having clean opinions. Is there a misunderstanding among your stakeholders about the meaning of your audit work on the financial statements?
I am not sure that there is, although I think that there is a misunderstanding in this case. My recollection of the Official Report is that the cabinet secretary said that the matter had not been raised by the external auditor. I think that that is incorrect. It clearly was raised by the internal auditor in the annual audit report, which is in the public domain. That is an important difference between the public audit regime in Scotland and the audit regime in the private sector. Public sector auditors have reported in public since the establishment of Audit Scotland and the report has been available on the NHS Tayside website and the Audit Scotland website since the conclusion of the audit. There is a very clear mention of the issue in the annual audit report for 2013-14.
When you talk about an annual audit report, I think of the one on financial statements.
No. I have here a copy of the report on NHS Tayside for 2013-14—
Sorry, but I was talking about the current year.
The same will be true for the current year. In every case, the auditor is required under the legislation to report to the members of the board and to me as Auditor General, and that report is available in the public domain. It contains a very clear reference in the executive summary to the retrospective transaction between the endowment fund and the NHS board.
But it is not referred to in the audit opinion on financial statements.
The audit opinion is a short-form opinion—it certainly was in 2013-14, and is about true and fair view. The transaction does not affect the true and fair view or regularity. The wider annual audit report, however, which is an important part of the public audit regime in Scotland and across the United Kingdom, contains a clear mention of the issue, and it is that which provides the basis for the further reporting that I can do under my statutory powers.
I have one final point.
Be very brief.
Liam Kerr asked who might know about the matter. In my experience, whenever there is a troublesome event, it is never just one person who knows about it. Other audit processes were asked about. For me, it is about using professional scepticism—what you might call an auditor’s nose—to know that something is not right. Did you have no feeling that something was not right at NHS Tayside?
Audit Scotland was not the appointed auditor in 2014.
I am talking about this year.
Oh—I am sorry. In that case, please respond, Fiona.
It has already been discussed that we have reported extensively on our concerns about the financial sustainability and the financial position of the board. That was in our annual audit report, which was then picked up in our section 22 report.
As a result of the issues that have been identified recently on the accounts, the e-health transaction is clearly a misstatement in the accounts, but is not of a material nature. I have already explained how we were not able to identify that because the conditions were not identified in the Scottish Government allocation letters.
The endowment fund issue is not an issue for the 2016-17 accounts; the consolidation into the group was accounted for appropriately.
I thank you all very much for your evidence this morning. I suspend the meeting for two minutes to allow a changeover of witnesses.10:14 Meeting suspended.
10:16 On resuming—
“Managing the implementation of the Scotland Acts”
“Managing the implementation of the Scotland Acts”
Agenda item 3 is consideration of the Audit Scotland report, “Managing the implementation of the Scotland Acts”. I welcome back to the table Caroline Gardner, who is joined by her Audit Scotland colleagues Mark Taylor, assistant director; Michael Oliphant, senior audit manager; and Morag Campsie, audit manager.
Auditor General, I believe that you have a statement to make.
Thank you, convener—I will be brief.
The report that I bring to the committee today is the fourth in a series of reports examining how the Scottish Government is implementing the new powers arising from the Scotland Act 2012 and the Scotland Act 2016. My report assesses progress up to the end of January and provides an update since I last reported in March 2017.
As the committee knows, the 2012 and 2016 acts devolved a range of responsibilities for taxes, borrowing and social security. Implementing those powers is a huge and complex programme of work. About 40 per cent of the Scottish Government’s planned spending in 2018-19 is expected to come from Scottish taxation and borrowing; that will increase to about 50 per cent by 2020. As a result, managing Scotland’s public finances is fundamentally changing. The Scottish budget is becoming increasingly complex, with greater uncertainty and volatility compared with when the budget was relatively fixed through the block grant from the UK Government. How the Scottish economy performs relative to the UK economy will have a greater influence on the Scottish Government’s choices over tax and spending than ever before.
Implementing and managing the new powers alongside the Scottish Government’s current responsibilities and responding to the UK’s withdrawal from the European Union has significant staffing implications. Over the past year, the Government has been modelling its workforce arrangements and refining its processes for collecting workforce information to help to inform its recruitment plans. That starts the process of workforce planning at all levels of the organisation, but there is lots still to do. It will be difficult for the Government to recruit the staff numbers and skills that are needed to deliver the powers in time.
I am pleased to report that the Government’s social security programme has made good early progress. However, a significant amount of work is required this year if planned timescales are to be met. That includes launching a new agency—social security Scotland—to deliver the carers allowance supplement in summer 2018, and putting in place the foundations for the IT infrastructure that is required to deliver the devolved benefits. That will require effective working with other organisations, such as the Department for Work and Pensions.
The programme is not without risk, and I highlight a number of the risks in my report, along with areas to prioritise. Ensuring that enough time is built into plans for assurance activities, procurement, recruitment and succession planning will be key to managing those risks.
Finally, the cost of implementing the new powers will be significant. The Government estimates that the social security powers alone will cost around £308 million to implement. By 31 March this year, it had drawn down the full £200 million UK Government contribution towards the cost of the new powers, with the excess to be funded from the wider Scottish budget.
There is a need for greater transparency and a better understanding of the overall costs of implementing the new powers to support financial planning. Having a clear picture of how much it is costing to implement the powers of the 2012 and 2016 acts and how that is being managed will help the Parliament’s scrutiny and decision making in the years ahead. My report also highlights the need for the Scottish Government to finalise and embed the governance and organisational arrangements for the new Scottish exchequer to oversee the continued implementation of the powers of the 2012 and 2016 acts and the management of Scotland’s public finances.
As always, we will do our best to answer your questions.
Thank you, Auditor General.
As ever, Auditor General, I am grateful for the report, which is detailed and comes across as fair and balanced. It highlights the good things but is not afraid to highlight the risks. Some of the risks on the IT system are highlighted at page 32 of the report. The committee has considered IT systems extensively over the past wee while. On that page, you highlight a number of risks for the delivery of the social security IT platform. The third one down relates to the initial design.
The Scottish Government has sent us a letter, which I presume you have seen, that rather robustly challenges that risk. It says:
“These statements are factually inaccurate … My officials discussed the detail of the CMS with Audit Scotland on a number of occasions and requested these inaccuracies be corrected … Unfortunately they were not.”
I was struck by the robustness of that language and would like to hear your thoughts on it.
You will not be surprised to hear that I disagree with the description of that risk as factually inaccurate. We take seriously the need to agree the contents of our reports with the people on whom we are reporting—in this case, the Scottish Government—precisely to avoid the committee having to get into arbitrating between my reports and those people and so that you have a professional evidence base on which to found your work.
We engaged well with Scottish Government colleagues throughout the process. It is correct that that issue was raised in clearance, and we were happy to add to the report the second bullet point in the third column of that risk, which recognises that the new case management system
“is based on an existing multi-benefit system that delivers complex benefits in other countries”,
as the Minister for Social Security says. Nonetheless, in finalising the report, I concluded that the risk that is set out on the left-hand side of that row remains. The Government is managing the risks reasonably well at this stage, but it is factually correct to say that that risk remains.
For the avoidance of doubt, is it correct to say that you disagree with the statement in the minister’s letter?
Yes. It is not at all factually inaccurate to say that that risk remains while reflecting the action that the Government is taking to mitigate it.
My question is on the same area, Auditor General. What is the basis for saying what you have said? Has some kind of technical assessment been carried out to enable you to come to that conclusion?
As you know, we have reported extensively on IT systems over the past few years. We have built up our expertise and experience in doing that. I ask Morag Campsie, who has been involved in a lot of that work, to talk you through the evidence base for the conclusion that I have drawn.
Morag Campsie (Audit Scotland)
As the Auditor General said, in the report, we are just trying to highlight some of the risks. As we have set out, the Scottish Government has chosen to create the platform on a component basis. We have tried to summarise that in exhibit 8.
To deliver the first wave of benefits, the Government has procured an existing multibenefit case management system that delivers benefits elsewhere. However, it will have to be developed to meet the needs of the benefits system that the Scottish Government chooses and the rules around it. Therefore, we feel that it is still a risk.
The project is still at an early stage. The contract was issued in November and the first series of sprints took place in January and February, just as we were finalising the report. At this early stage, we are just highlighting the issue as one on which an eye needs to be kept. The fact that the system is used in other countries helps to some extent, but it is at an early stage and it still needs further development, which is why we are highlighting the issue.
Given your comment about the CMS being able to support the wave 1 benefits, are you saying, from your technical assessment, that you consider that it will not be able to support post-wave 1 developments without another piece of software being procured? I think that that is the issue at stake. The minister is saying quite clearly that it will be able to do that.
As we have set out, the system already delivers some complex benefits in other countries. The later benefits—the disability benefits—are quite complex, and it will not be until the Social Security (Scotland) Bill is passed that decisions are made on some of the rules and assessments. The test system will then need to be built around that. The initial contract is just for the wave 1 benefits, which are less complex. In our view, there will still be quite a lot of work to do in further contracts to develop the system further.
Have you seen the software?
We have not. As I said, the first few sprints took place in January and February, which was when we were finalising the report. We had not undertaken any work in the area at that time.
I should say in relation to the procurement process and the system that, as you will be aware, there are assurance frameworks in place through the Scottish Government, and there is technical assurance. The tender had gone through that technical assessment and it was given the green light to go to the next stage.
Have you spoken to IBM, which is the contractor, to find out its view? There is clearly a requirement for it to deliver the system in such a manner.
That did not form part of the audit. As I said, it is at an early stage. The contract was just awarded as we were going through the process, so we did not undertake that. It might be something that we consider doing as we continue to look at the area in the future.
Mr Coffey, Mark Taylor wishes to add some evidence.
Mark Taylor (Audit Scotland)
I will just add a little to what Morag Campsie said. It will probably be helpful if I clarify the purpose of exhibit 9. It is not a list of things that have gone wrong; I would characterise it as a list of things that the Government needs to get right. As Morag said, the system has not been built yet, so we are not in a position to undertake a technical assessment of it. However, from our perspective and our experience of working on similar systems, this is something that the Government really needs to get right so that, as the system is built, it has the ability to have the other components plugged into it.
That is the risk that we are looking to flag up at this stage. As the Auditor General said, our judgment is that it is a live risk. It is something that the Government is alert to, given the cabinet secretary’s response, and something that it is managing. We flag it up for the committee’s purposes and for the wider purpose of Parliament being aware that it is an issue that needs to be managed and worked through.
I understand that. However, you say that the CMS might only be able to process wave 1 benefits, while the Government—and perhaps the contractor, if we asked it—would say the exact opposite. That is a fundamental difference. In the years for which I have been a member of this committee, I have never picked up something in an Audit Scotland report that says the polar opposite to what the Government is saying and, perhaps, what a contractor would say.
The other bit of evidence that I would play in is exhibit 5, which breaks down for you in a bit more detail the wave 1 benefits and the post-wave 1 benefits, as the Government describes them. It is clear from that that, in terms of complexity, the numbers of people who are affected and the amounts of money that are involved, they are very different things. Wave 1 is very small compared with the post-wave 1 benefits, and that plays into our judgment as well.
I echo strongly what Mark Taylor has said. We are not saying that this is something that has gone wrong; we are saying that it is something that the Government needs to stay on top of, given the importance of a smooth delivery of the benefits to the people who rely on them, who are some of the most vulnerable in Scotland.
Of course, but you have not carried out a technical assessment, you have not spoken to IBM and you have not seen the software, so how can you conclude that this is a possibility when you are being told the opposite—that it is not the case?
Our judgment was that the risk is inherent in the way in which the system has been pieced together. Clearly, where there is one component that is a small but important part of a platform on which everything else is built, that component needs to be designed and built in a way that allows other components to be plugged in. That is the point that we are making and, from our perspective, it is a significant thing that the Government needs to get right in future.10:30
From memory, more than half of the cost of transition for the social security system is down to IT systems. How are we monitoring the cost estimate for the delivery of the programme? I do not see a general overview of the overall cost estimate.
Exhibit 7 on page 26 sets out the breakdown of the figure in the bill’s financial memorandum of IT costs of £190 million. The contract that we are talking about is in the order of £8 million of that full package, so although we are talking about a core part of the system, that gives you a sense of how much extra has to be built on to it. In the report, we comment on the nature of the costing of the IT system and the stage that it is at. A lot still has to be built and decided on. As we say in the report, we expect to see greater clarity and precision on the amount of IT costs as those decisions are made. We will be alert to those and will continue to monitor them as we go forward.
Are they on track at the moment, as far as we can tell?
Morag Campsie might want to add to this, but I can say that we have made comments elsewhere in the document about the visibility of the overall cost of much of the work and the refinement of that. At the moment, the money that has been committed is within the budgets that are available.
Thank you for that.
One of the biggest concerns is about having people to staff the process, as about 1,500 staff will be needed. According to your report, a fair number of them have come from other parts of the Scottish Government. In paragraph 19, you comment:
“This has put pressure on other directorates’ ability to deliver business-as-usual activities, other new powers, and plan for the impact of the UK’s withdrawal from the EU”.
Can you quantify that in any way? Is it just an assumption or is it based on something that you have seen?
I will ask Michael Oliphant to come in, in a moment, but first I will say that there is a straightforward sense that we get from our engagement with Government, as its auditors, that people are under pressure. There is business as usual, which is demanding in itself, the new financial powers are coming through and there are preparations for the UK’s withdrawal from the European Union—whatever that may mean for Scotland, which is a very live question at the moment. From our engagement, we know that people are under pressure. We also know that people being transferred from other parts of the organisation into the social security team is having an impact in terms of pressures elsewhere.
Michael, do you want to put a bit more flesh on the bones of that?
Michael Oliphant (Audit Scotland)
Sure. The report points out that the Scottish Government has taken some important steps in identifying its workforce requirements, particularly over the past year. We would like to see it extend that over five years, and it has started on plans to do so.
A lot of that comes down to the movement from generalist skills to more specialist ones, particularly in matters such as long-term financial planning, financial modelling, economic forecasting and, as we have touched on already, IT and digital skills, an element of which is about the need for cybersecurity specialists. A lot of what is going on is about current needs, but we are keen that the Scottish Government map out its longer-term needs and that it factor in, as best it can, things that are unknown at the moment. Colin Beattie mentioned the UK’s planned withdrawal from the EU being one of those.
The committee has talked about IT skills shortages quite a number of times in the past, and Willie Coffey has raised them again today. However, you are talking about a wider spread of skills shortages. Is there a skills shortage other than the IT skills shortage, of which we are already well aware?
Yes, there is, and that is part of the challenge that the Scottish Government faces. It is dealing not just with getting the numbers of staff in, but with the availability of the required skills in the market, and it is trying to compete externally, too. That is also a risk that the Scottish Government needs to manage in relation to retaining the staff that it has now: it must not lose them and their skills to external providers, whether in relation to IT or finance, which is why it has undertaken some work to develop its talent management programme with a view to retaining key skills, as well as looking for additional support.
I suppose that it would be far too simplistic to say that if a body of work were taken from one area of the civil service to another, some of the skills would follow it as there would be less work in the original area.
Are you referring to skills in the Department for Work and Pensions?
In principle, that is probably right. In practice, the scale of DWP activity that is transferring is very small relative to its overall work, but the work is still very significant for the Scottish Government, which has not had to do it before. It is unlikely that there will be surplus people in the DWP on any significant scale to help to fill the gap. I know that the team has been looking at that. Perhaps Michael Oliphant will add to that.
There is not much to add. However, one of the key things that we have flagged up to the Scottish Government in our discussions on that specific topic, which the Scottish Government is keen to include in its longer-term workforce planning, is that when a member of staff leaves one directorate to move into another part of the Government, it must be ensured that a transfer of knowledge takes place. That is also important when short-term contractors are used or when people come in on secondment. Although that might provide a short-term fix with regard to skills, it is important that, as part of their work for the Government, people pass on their knowledge and expertise to others.
Are you satisfied that there are fairly robust processes in place for that to happen?
From the work and analysis that we did over 2017, we can see that the situation is improving, but more needs to be done to identify the number of people, the type of roles and the skills that will be required over the longer term.
I am pleased to hear that the Scottish Government has put in place a good workforce plan, because that is certainly the first step, but does it have a robust recruitment process? I realise that it is limited by what is available in the market, but is the process constructed in such a way that it will get the best out of the market?
It is perhaps too early for us to say, because a lot of the substantial recruitment—the 1,500 members of staff for the social security agency that Colin Beattie mentioned—is still to take place. That is certainly one of the biggest challenges that the Scottish Government faces in relation to social security. It is not just the skills, but the numbers that are needed in place, particularly with the external competition that is faced.
Clearly, not all 1,500 will be highly skilled IT or financial experts. A lot of them will be counter staff and so on who will deal with people. Is there more that the Scottish Government can do in that regard, or is it doing all that it can, given the limitations of the market?
As we say in the report, some important early steps have been made in identifying immediate need. Some steps have been taken to integrate the workforce requirements in terms of recruitment processes, which were previously done in isolation, with each directorate identifying its own recruitment needs and undertaking recruitment campaigns on its own. A better process is now in place to co-ordinate and integrate the workforce planning requirements and the recruitment strategies that come out of that. It is just too early to say yet whether that will be effective.
Auditor General, you mentioned at the outset the £200 million budget being drawn down. To put that in context, key message 4 of the report says:
“Under the fiscal framework, the UK Government will contribute £200 million to the costs of implementing the new powers. The Scottish Government will have drawn down all of this by 31 March 2018”
and we assume that it has. Key message 4 continues:
“The Scottish Government has not estimated the total overall cost of implementation.”
That statement rather concerns me. I think that I am right in saying—you will correct me if I am wrong—that you raised exactly the same point in your report in March 2017, and said that the Scottish Government really ought to be working out how much money it will need to do this. Is it true that nothing has been done in that regard and, if so, does that concern you?
First of all, the sum of £200 million was agreed in the fiscal framework as the UK Government’s contribution to Scotland’s implementation costs; it was never intended to be an estimate of the costs of doing it all.
The sum was negotiated and agreed between the UK and Scottish Governments. Beyond that, and for that very reason, it is important that the Scottish Government develops its own estimates and makes them more transparently available to Parliament and others with an interest, in order to support Parliament’s decision making on, for example, the Social Security (Scotland) Bill and the proposals on the new tax powers.
It is not fair to say that nothing has been done, but it is becoming increasingly urgent that the work be completed and made transparent. Mark Taylor will tell you a bit more about what we have seen in the past year.
To pick up on the premise of Mr Kerr’s question, we made that recommendation last year. We emphasise in our “Managing the Implementation of the Scotland Acts” report that that has yet to be done. It is important that it is done, so that Parliament and the public have a sense of how much the package of new powers will cost. There is information available on the costs, including the £308 million estimate on social security that we have talked about, and we were able to pull together figures for the report—you will see them in exhibit 4—from various sources that are available in the public domain.
Our essential point is that the Government has not done an overall assessment. To illustrate the point, I highlight that we had to work hard to pull together the numbers in exhibit 4 from lots of different places. There needs to be greater clarity about the total expected cost. That cost will need to be refined as decisions are made and work develops, but it is important that it is clear to Parliament to what figure the Government is working.
In the report, you go on to say that the excess—that is, the amount above the £200 million contribution; you mention a cost of £308 million to implement the new social security powers, for example—will need to be funded
“from the wider Scottish budget.”
Will you put that into context for me? I presume that that is cash that could or should be spent on the Scottish Government’s other spending commitments. Is that correct? Will the money have to be pulled from one place and spent somewhere else?
As the Auditor General explained, the £200 million is a contribution from the UK Government that was agreed through a political process. The expectation was always that the package of powers would cost more than that. Therefore, by definition, the balance needs to be funded from the Scottish budget, so the Scottish Government and the Scottish Parliament will have to make a choice about how that will be done and how much will be allocated in order to achieve those aims. Our point is that there needs to be greater clarity on the extent to which that is likely to be the case. We also make points about how those costs are treated in the budget, so that there is greater clarity for Parliament about the money that has been allocated and the timetable for that.
The lack of clarity in planning gives me cause for concern. Mark Taylor mentioned the £308 million implementation costs related to social security. Paragraph 30 of the report says:
“At the time of publishing its 2017/18 draft budget the Scottish Government had not prepared detailed spending estimates for the social security programme”.
Where will the £308 million come from? Is that a finger-in-the-air estimate? How accurate is the figure?
The £308 million is the initial assessment from the Social Security (Scotland) Bill’s financial memorandum, and Government has given evidence elsewhere on its make-up. Inevitably, it includes a fair number of estimates and assumptions about decisions that are yet to be made and what the financial consequences of those will be.
The figure is the Government’s current estimate. In our report, we describe how the Government needs to continue to refine that estimate as it takes decisions.
One big part of that, which we touched on earlier, is the IT element of the cost and the extent to which there is a fair amount built into the estimate for uncertainties—“optimism bias” is the technical phrase—and we are clear in the report about the need for the Government to bring that figure down as it makes decisions, and to provide more certainty about the expected cost in that area.10:45
Given that, in March 2017, you recommended similar things to what you recommend now, do you get any sense that the next year will be different and that you will produce a different report this time next year?
We are always optimistic. This time, the basis for that optimism is that we understand from discussions with the Government that it intends to give more indication of the overall cost in the section 33 progress report that it will prepare over the next month. If that happens, we will welcome it.
I want to ask about the new powers on borrowing and reserves. I confess that I do not entirely understand paragraph 130 of the report and I wonder whether you could clarify it, Auditor General. It says that the Scottish Government has not agreed the overall principles and policies for borrowing and the use of reserves, but that the powers are now available. It is not clear to me from the subsequent paragraphs whether that means that the Government is not able to use the powers yet, or whether it is using them under some temporary agreement with the Treasury.
I refer you to exhibit 1 on page 8 of the report, which sets out the timeline for the new financial powers. The block for 2017 sets out the overall and annual limits for the increased borrowing and reserve powers. Those powers are now in effect and the Government has access to the overall limit, subject to the annual limits for borrowing and for moving money in and out of the reserves.
The point that I was trying to make—obviously not very clearly—in paragraph 130 is that it would be a real contribution to financial transparency and Parliament’s decision making if the Government were to publish the principles that it plans to apply in using the borrowing powers, such as the extent to which it intends to draw down money to invest in capital infrastructure; the extent to which it intends to hold back some allowance in the borrowing powers or the reserves to allow for the unexpected that might come out in the foreseeable medium-term future; and the policy decisions that it needs to make about the way that those things will be used, rather than provide Parliament with proposals for decision in isolation each time.
Paragraph 131 refers to a memorandum of understanding that was expected at the end of March, which has now passed. Did that materialise?
I am afraid that we have no immediate information, but we can get back to the committee on that.
I want to go back to software. In paragraph 76, you alert us to the potential risk in our dependency
“on the DWP to modify ... systems”
so that we can make them fully compatible with ours. Do you know of any agreement in place in the project for the DWP to modify its systems in time? We have no control over the ultimate delivery of that particular aspect of the system, unless it is by an agreement that is written into the contract. Will you tell us a wee bit more about that?
In the report’s key messages on page 10, we conclude that the Scottish Government has
“effective working relationships at an official level”
with the UK bodies involved, which are the DWP and Her Majesty’s Revenue and Customs, primarily. I ask Mark Taylor to talk in a little bit more detail about that.
The complexity of the programme means that there are discussions on a range of systems and interfaces across the activities that are set out in exhibit 5, and those are at different stages. We have evidence, and we say in the report, that, at an official level, the DWP and the Scottish Government are working well together on those. We also set out in the report some of the governance arrangements at official and ministerial levels through which those discussions take place.
As a result of that, there is a degree of shared project planning and a degree of Scottish Government project planning. The risk there is around making sure that those two things are co-ordinated and work together. In paragraph 76, which you mentioned, we are clear that that is a fundamental part of making sure that things progress on time.
It is important for the Scottish Government to manage its relationship with the DWP and that both parties continue to work well together if the whole package of change is going to be delivered to the timetable that has been set out.
If everyone is working well together, why do you say in paragraph 76 that
“There is a risk that Scottish Government requirements are not given enough attention due to the DWP’s other priorities”?
Why would you say that, if everybody is working well together and getting on fine? Is there a contractual agreement in place to deliver this or is it a “getting on fine” arrangement?
The project is at an early stage. We can point to what is being delivered and the individual agreements between the DWP and the Scottish Government in relation to things such as Scottish universal credit choices, for example. Particular arrangements and agreements are being put in place around some of those areas and around the wave 1 benefits.
The reason for flagging up that risk at an early stage in the project is to make it clear that, from our perspective, it is an absolutely fundamental thing that the Government needs to get right, and both parties have a part to play in that. We have no direct visibility over the operations of the DWP—we talked at a previous session about some of the limitations in the audit arrangements. At the moment, there are no immediate signs of concern, but that is an inherent risk in relation to the project, and the Scottish Government and the DWP absolutely need to pay attention to it.
Just to be clear, is it the case that there is no contractual obligation on the part of the DWP to deliver what is required on time for the project?
It is worth being clear that, in contrast to the arrangements for the devolution of income tax, which the Scottish Government is required to collect and administer through HMRC, the Scottish Government has chosen to deliver its social security powers with the DWP. That changes slightly the dynamics and the set of things that need to happen. As Mark Taylor said, the evidence that we have suggests that, so far, it is working well. There is still a long way to go and it will depend on good joint working from both parties—here in Scotland and in the DWP.
The Scottish Government has promised half of the 1,500 jobs to Dundee, and the first wave of benefits have to be administrated and given next summer, but the Government has still not identified a premises for the new agency in our city. I understand that the minister might be making an announcement on that next week. Are you concerned that it is indicative of where the Scottish Government is in its planning process that, to date, it has not identified a premises for the operation?
The overall message of the report in relation to social security is probably that the early progress that has been made is good but that 2018 is absolutely critical in terms of establishing the social security agency and being able to deliver that first wave of benefits next summer.
We have talked about the range of things that need to happen for that to be achieved successfully. It is about premises, staffing and the IT system. Although the early progress has been good, there is a huge amount to be done over the remainder of this calendar year to make things happen in practice.
Would you have expected something as fundamental as where the agency will operate from to have been identified by now?
The question is less about whether that particular announcement or decision should have been made by this stage and more about the overall ambition of looking to deliver the first wave of benefits by the summer of 2019. We think that it is achievable but, as we say in the report, it will be challenging to get all those things in place. Naturally with that timescale, decisions will be announced in relatively short order. There is no room for delay or slippage in that.
I understand that nearly 600 people applied for the first 80 jobs that were advertised, so there is certainly a lot of interest in the community regarding the jobs.
I thank you all for your evidence this morning. We will now move into private session.10:54 Meeting continued in private until 11:30.