I welcome everybody back to this morning’s meeting of the Public Audit Committee. We have had a changeover of witnesses. I am pleased to welcome a new set of guests who have joined us for consideration of “The 2024/25 audit of Historic Environment Scotland”. I welcome Katerina Brown, who is the chief executive of Historic Environment Scotland; Sir Mark Jones, who is the chair of the board; and Stephen Uphill, who is the chief operating officer. I am also pleased to welcome back Shona Riach, who is the director general exchequer, strategy and performance, who was with us for the earlier evidence session, and to welcome Kenneth Hogg, who is the director for culture and external affairs—both from the Scottish Government.
We have some questions to put to you but, before we get to our questions, I invite Katerina Brown to open up with a short statement.
Thank you, convener.
I thank the committee for inviting me to give evidence. As a chartered accountant, a fellow of the professional body and a former auditor, I welcome the Auditor General’s section 22 report. When I started in my role in September 2024, I welcomed the work that allowed us to agree a new business model with the Scottish Government. That model enables us to reinvest additional income into the care and maintenance of our cultural assets and to support us in the many challenges that we face.
As any new CEO would, I sought to understand how the organisation functioned. As I did so, it became obvious that there were many areas of development around compliance, governance and culture. I reported those areas of concern to the board in November 2024 and February 2025. As a follow-up to those concerns, I directed our internal audit function to identify specific areas in which we could improve, working with the executive leadership team and the audit and risk assurance committee.
As a non-departmental public body, we have a statutory responsibility to be the custodian of Scotland’s cultural heritage. We are the regulator for historic buildings and scheduled monuments, and we must ensure financial prudence in how we manage public money. My duties as accountable officer cannot be delegated and I am working closely with the newly appointed interim chief operating officer to oversee the stewardship of the organisation, in line with my duties as chief executive and accountable officer.
The section 22 report, along with the external review conducted by David Martin, will give us the necessary tools and insights to make further improvements in how HES performs as an organisation for its staff, its responsibilities and the many people we welcome to our sites across Scotland.
Thank you. For the record, Ms Brown, you said that you accepted the recommendations and findings of the Audit Scotland report. I look to you and to Sir Mark Jones to confirm that that is the case.
It is the case, yes.
Sir Mark is nodding. I put the same question, which we raised with the permanent secretary earlier, to Shona Riach. Is that the position of the Scottish Government, too?
Yes, it is.
Thank you for that clarity.
I have a couple of opening questions before I invite the rest of the committee to put some questions to you.
Mr Hogg gave evidence to another committee of this Parliament recently, in which he said that you, Ms Brown, were investigating some of the things that were highlighted in the section 22 report. He said that you were investigating the electronic purchasing cards, travel expenses, data protection failures and the alcohol bill from a leaving do, which is highlighted in the report. You were investigating those things—was that linked in any way to your absence from work?
The short answer is no. On joining, I undertook a number of activities to understand how the organisation worked. All those predated the period of absence. There were regular meetings with the executive leadership team and with staff across the country, and I approved expenses on behalf of colleagues and attended various committees in the organisation. Numerous issues came to light, of various scales, and they were reported to the board and committees, specifically on the matters that have arisen. They were raised at meetings of the audit, risk and assurance committee in November 2024 and February 2025 and, subsequent to that, our internal audit function undertook reviews of those areas over a phased period of several months.
I think, Ms Brown, you felt that you were treated unfairly by the board and you reported that to the Scottish Government. Again, was that around your investigation into those areas that you have identified?
On 2 May, I visited my general practitioner because the situation at work had become extremely difficult. On her advice, I was signed off work to protect my health and wellbeing. That is something that I had never done before in my career.
I am sorry to hear that. Following up on that, Mr Hogg or Ms Riach, can you tell us how the Scottish Government responded to Ms Brown’s view that she was being treated unfairly by the board of the organisation?
During that period, we were in close contact. Ms Brown and I spoke regularly. We were keen to facilitate good working between the CEO and the board. We made clear to Ms Brown that any complaints that she wanted to make would be treated fairly and investigated fully. We also discussed with the board the possibility of bringing in mediation to work with the senior team to resolve some of the issues that had become clear. Throughout this whole period, we were in close contact both with Ms Brown and with the board. Kenneth, do you want to add anything to that?
No, I do not think so.
Mr Hogg, I will ask you something that we raised with the principal accountable officer earlier this morning and which is the top line in the Audit Scotland report. Why, for six months, was there no interim accountable officer in place?
The first thing to say is that we recognised the seriousness of the situation, and it is something that we actively addressed throughout the period. This was not a case of not paying attention.
The first option was to resolve the situation with the existing accountable officer and chief executive officer. It is important to say that the status that Ms Brown has described was not the case throughout her entire five-and-a-half-month absence. After the first two months—Ms Brown may want to comment more on this—she indicated that she wished to return to work, and I can say more about that.
The accountable officer should be the chief executive officer, and that was the first option. When it became clear, however, that, despite Ms Brown’s intention and wish to return to work, and despite the querying that we had carried out about the rationale for her on-going absence, the board nevertheless did not want her to return to work, we explored other options.
We first explored whether there was anybody else internally, in line with the provisions of the Scottish public finance manual, who could be appointed as an interim chief executive and, therefore, interim accountable officer. Had there been a permanent director of finance in place, that would have been one option, but that was not the case. Had there been a chief operating officer at that time, that might have been an option, but that role did not exist at that time.
We also considered the other senior directors of the organisation, who, for various reasons, were also not available to be appointed, largely because of their own involvement in some of the on-going proceedings.
11:30
Therefore, we looked at external candidates. On 2 July, following a request from the board chair at the time, Hugh Hall, we offered the names of three candidates, all of whom were former chief executives and accountable officers, as options to bring in as an interim CEO. The board preferred a fourth candidate whom it had identified. I met that individual on 20 August and confirmed there and then that we would happily appoint them as an acting accountable officer. That did not progress.
In summary, the lack of an accountable officer or an interim accountable officer during that period did not result from a lack of trying. We explored every possible option to achieve the appointment of one.
You understand, Mr Hogg, why the Scottish public finance manual requires that there must be an accountable officer in every organisation, including a non-departmental public body. There are reasons for that related to ensuring that public money is spent wisely—that there is value for money and economic efficiency in organisations and so on.
If somebody who had been approved by the board was also approved by you as the Scottish Government sponsor person three months into the absence of Ms Brown, why did that appointment not happen and why was there a further three-month wait before somebody was put in post?
In the case of the candidate who was put forward by the board, the first thing that needed to happen was for the board to appoint that individual as interim chief executive. The accountable officer must be an employee of the organisation—that is provided for in the Scottish public finance manual. There literally was not somebody in place whom we could designate accountable officer. The sequence had to be that, first, they were appointed by the board to a position in the organisation and then the principal accountable officer, Joe Griffin, would have delegated to them responsibility as the interim AO.
I completely accept your comments about the importance of the accountable officer role in ensuring regularity, propriety and value for money in relation to public expenditure. Those were the very reasons that made addressing the situation my number 1 priority in my role.
Okay, thanks. Other members of the committee might return to some of those matters, but I now invite the deputy convener to put some questions to you.
Good morning to the witnesses. I will carry on the same line of questioning. The Auditor General gave evidence to the committee just a few weeks ago; I presume that you followed that session closely in preparation for today. The Auditor General said in that meeting:
“when it became clear that the accountable officer was going to be absent for more than a month, the Scottish Government ought to have appointed a substitute”.
He also said:
“We have seen a lack of clarity in why the Scottish Government chose not to appoint an accountable officer”.—[Official Report, Public Audit Committee, 14 January 2026; c 27, 9]
Ms Riach, do you agree with that conclusion that the Auditor General gave us?
I would not say that the Scottish Government chose not to appoint an accountable officer. As the permanent secretary said this morning and as Mr Hogg has just set out, we were very actively seeking to appoint an interim accountable officer. For the reasons that Mr Hogg has given, that was not possible.
I absolutely agree with the view that it is regrettable that there was not an accountable officer in place for that prolonged period. That is why, during that period, we were taking every action that was available to us to try to put someone in place. Frankly, it is also why we were working closely with the board to look at options for an interim CEO and accountable officer, even though our first preference remained for Ms Brown to be put back in post and therefore able to perform her duties and responsibilities as an accountable officer.
I cannot get my head around the fact that an organisation as big and well known in Scotland as this, with such a high-profile role as a public body, could not find a single person in the whole organisation who could step up to the mark for a few months. How is that possible? Did no one want to do it? Was nobody suitably qualified? Were there relationship issues between senior executives and the board, or did you have issues with the board itself?
I am happy to respond to that. The Auditor General, in his section 22 report and in his previous evidence to the committee, touched on some of the issues. He highlighted instability in the senior leadership of the organisation. Part of the answer to your question is that there was not, for example, a permanent finance director in post.
It did not need to be a permanent finance director who stepped up to the mark. My question is whether there was a lack of willingness to do the role or a lack of competence.
If we are talking specifically about the organisation’s existing directors, it was the view of the Scottish Government and the chair of the board that nobody was available who could be appointed as an interim accountable officer, because their candidacy for such a role would be compromised by their own participation and involvement in some of the on-going issues. Had somebody been available in that category, they would have been our first option.
I can see why that makes sense. How many people are we talking about here? When you say the directors, do you mean the executive managers in the organisation, or do you mean people who sit on the board?
I apologise—I specifically mean the most senior staff. Under the Historic Environment Scotland Act 2014, somebody on the board cannot be appointed as chief executive. Such an option was considered and quickly rejected, because it is ruled out by statute and the Scottish public finance manual in combination.
Ms Brown can clarify this, but we are talking about approximately six or seven—
Seven.
—senior individuals, some of whom were in roles that meant that they would not have lent themselves as ideal for a financial control role. However, some of them were, and it is those individuals who we, along with the former chair and, I presume, the board, considered. The former chair confirmed to me that the board’s preference was instead to bring in a candidate who was not an existing member of staff. That was the route that he asked me to pursue.
On 8 August, a specific individual was referred to me. I corresponded with that individual and met them on 20 August. Given their relevant background experience, I confirmed that I was happy that they understood the role of accountable officer. They had been in a senior role at a public service organisation previously, and all that needed to happen was for the board to appoint them to, frankly, any senior executive role—the role that was being discussed was interim chief executive. Had the board done that and made them an employee of the organisation, the Scottish Government would have immediately delegated to them the role of interim accountable officer.
Why did that not happen?
I actually do not know. It is a matter for the board as the employer.
Let us ask the board. Sir Mark, why did the board not approve proceeding with the Scottish Government’s recommendation?
I was not there at the time, and I am not certain of the board’s thinking on the issue. When I became chair, it seemed to me that the most straightforward way to deal with it was to ask our existing chief executive and accountable officer to come back into function, which is what happened.
I appreciate that you were not there, and people’s roles change, but are there any minutes of board meetings at which the matter was discussed, so that we know how the decision was reached? The Scottish Government does not even know, so how on earth will we ever know?
I am afraid that I do not know which process led the board to decide not to appoint the individual in question.
Okay.
I think that the person in question was a former trustee of Historic Environment Scotland, and there was some anxiety that somebody who had recently been a trustee might find it difficult to carry out the role of chief executive without running into what were already difficult relationships between the board and the chief executive.
Goodness. I appreciate that, if you do not know, you do not know—it is perfectly fine to be honest with us.
Reverting back to the Scottish Government, then, I have to say that I find it difficult to imagine how you can come to the committee and say, “Oh, I don’t know why they didn't proceed.” Did you ask?
Can I answer this question? The other point that is very relevant here is that the board was also in very live discussions with Ms Brown about what was going to happen next with regard to her position. It was not straightforward and, ultimately, the board took the decision to suspend Ms Brown.
The Scottish Government was having very live discussions with the board about the rationale behind that decision, and my view is that the reason for the board not pressing ahead was that those discussions were very live at that point in time and that it would have been inappropriate for it to appoint an interim CEO when it was also in very active discussions about whether its current CEO could return. That was the complicating factor.
Yes. There is a difference between someone being off sick for a few weeks and being off for six months.
Yes.
That had been on-going and, of course, discussions were live and on-going, too, as is normal in such scenarios. However, the Scottish Government has a duty in this respect. It was not unfortunate, or regrettable, that no accountable officer was appointed; it went against statutory requirements not to appoint one. It was in breach of the manual.
We absolutely recognise that, and that is why, as Mr Hogg has set out, we were in such live and active discussions and exploring all possible avenues to appoint an accountable officer.
Okay. I will move on, because I think that there is a wider issue here. From all that I have been hearing in our evidence sessions, it strikes me that there is what sounds like an absolutely horrific culture at the very top of a large public body that is publicly funded and that receives huge amounts of public cash. Indeed, it also has a huge responsibility with regard to our historic and cultural sector, and we all want it to succeed. However, we have just heard, in that extraordinary exchange, that six or seven senior directors of the organisation were unwilling, or unfit, to step up to take it over on a short-term basis. There have been on-going issues between the board and the chief executive, and, as far as I know, live proceedings might be under way in that respect—I do not know. This does not point to a happy ship in any way, shape or form. What on earth has the Scottish Government been doing for the last year?
You have correctly identified some serious concerns, which is why the Scottish Government has been in such active and regular contact with HES both at board level and at senior executive level, as well as, via our sponsorship team, with lots of individual parts of the organisation. When Ms Brown was appointed to the role of CEO, we discussed the importance of her looking at all aspects of the business, including governance and accountabilities. She was taking forward that important work, which we very much saw as a necessary part of assuring ourselves about what was happening at HES. Unfortunately, that work uncovered some substantive concerns that, since then, we have been working collectively and together on finding a way through and resolving.
Other members will go into those issues in more detail during the session, but, as the convener has alluded to, it seems that, according to the timeline of events, someone new was brought into the organisation, did a valid piece of work to uncover challenges with governance procedures and practices and with leadership and, in doing so, unearthed what were clearly unacceptable behaviours and practices. The board were clearly unhappy with that, as were other senior members of staff, and the individual was then off sick.
I do hope that you are okay now, Ms Brown, and I hope that you are being properly supported by the organisation and the board.
Yes, thank you.
Good.
11:45
It might be helpful to add that I contacted both the organisation and the Scottish Government multiple times throughout that period to inform them of the absence—in particular, at the point when the absence would exceed four weeks, which is in line with my duties as accountable officer. At that point, in May, I indicated that the absence would be approximately another two to four weeks, which covered the period of May and June, approximately—I did that.
In July, I wrote to the board and the Scottish Government to say that I was fit and ready to return to work. There was a point in July when I notified them of my intention to return to work on 28 July. However, at that point, I was advised by the board not to return. There was a series of attempts to return to work, which were communicated to the Scottish Government. The sponsor team was fully informed, in line with my duties.
It is worth saying that it was not an entire period of six months’ absence. It was two months of absence, and then four months of attempted return. There was a point in August, starting on 22 August, when I commenced a series of meetings with the board and a member of the Scottish Government sponsor team to discuss what the return to work and the accountable officer duties would look like. I was signed back on, but we had those meetings first. Between August and September, there were steps to return.
Did you get the impression that they just did not want you back? I am sorry to be so direct, but I think that that is the only way in which we will get to the bottom of this.
I was advised by the board that they had received a letter addressed to them containing allegations against me, and they advised that I refrain from work until the allegations were investigated.
Do you think that you ruffled some feathers when you undertook the work that you did to unearth those governance issues when you joined the organisation?
It was clear to me, even in the recruitment process, that there were challenges with HES. There was a well-known understanding that it was 10 years old as an NDPB, so it was evolving. Part of the recruitment—indeed, part of the reason why I was attracted to the role in the first place—was that it was clearly a transformational role to help to improve the organisation. It was acknowledged that many organisations rightly admit that they have problems. I had some awareness that there would be issues to address.
I will take that as a diplomatic answer, and I will not push it any further for now.
I invite Colin Beattie to put some questions to Ms Brown.
I would like to cover specific issues on governance and one or two of the activities that have come to light. What I am not clear about—I hope that you can explain this to me—is how long those cultural practices had been carrying on in HES. Everything that we have seen has been fairly recent. Is it a fairly recent thing, or has it been going on for years?
I can contribute to that. When I joined, I produced a summary of some matters that were unresolved—I called them “inheritance” matters—which were of varying durations. Some had been unresolved for a year or two, and there were some bigger, well-known challenges that would take longer, such as capital work. Any organisation has a pipeline of matters that it is dealing with, and that was quite apparent at HES.
Some of the more challenging observations were around how we were structured—simple layers of efficiency, which some people called bureaucracy. There are many layers and grades in HES. It had recently undergone a restructuring of roles and responsibilities with a view to improve that, so there was a bit of settling in after that reorganisation.
My observations could be summarised by saying that it was evolving as a body. There was no evidence of any deliberate matters or anything of any serious concern. It was an organisation that had an opportunity to improve itself on matters that were within its own gift, such as efficiencies and how it was structured.
To your knowledge, were any issues raised with the board in previous years in relation to irregularities or non-compliance with the rules?
I was not aware of areas of non-compliance that were long standing. I was aware more of inefficient practices in the way that the organisation is structured and operates.
In your opinion, this is not a long-lasting issue that HES has had for years.
I am trying to understand the culture of HES, how it has developed and where it went wrong.
There is a structure at HES that is quite siloed. There are very specialist departments, and they work quite individually in some cases. In some cases that is appropriate, and in other cases there is quite open dialogue, so it is quite hard to generalise about a culture of non-compliance. That would go too far, but I acknowledge and recognise instances in the Auditor General’s report where there have been cases of non-compliance.
I am just trying to get at whether those processes should have been picked up earlier by internal audit or perhaps by the board. If we are talking about the board, perhaps Sir Mark may have a view on that.
I can only look back on the history of HES from an outsider’s perspective. Since I arrived there, I have been trying to focus on setting right some of the things that are most obviously wrong. First of all, as you say, there was the absence of an accountable officer. It was obviously necessary to deal with that and bring back Katerina Brown as chief executive officer and back into function as accountable officer. Since then, we have gone on to tackle some of the evident problems that have arisen—one of those was a lack of leadership of the senior executive team, and the appointment of Stephen Uphill has been very helpful in overcoming that lack, which was very much felt.
It was clear from the concerns raised in the section 22 report that we needed an external person to come into HES and carry out an absolutely thorough review of the organisation of HES and of its culture. I asked the Scottish Government to nominate someone to do that, and it nominated David Martin. He started on 19 January, and it is hoped that his report will be delivered in May. I hope that that report will tackle the questions of culture and the questions of organisation, both of which are badly in need of being properly looked at, understood and then reformed.
Has there been a problem with HES since its inception? I think that there may have been. HES is the product of an amalgamation between the Royal Commission on the Ancient and Historical Monuments of Scotland and Historic Scotland. It is possible that that amalgamation was not carried through in a way that led to a completely coherent organisation. Historic Scotland had been operating as an agency and was therefore not used to having a board of trustees to which the senior staff were responsible. It might be that, over a period, there was a difficulty in the relationship between the board and the senior staff. That is speculation on my part and I say that as an outsider, not as an insider. I have not had the opportunity to go through the archives, as it were, to work out the story from internal documents.
Your comments are very helpful. Having experienced such mergers in the past, I can understand the tensions that they sometimes bring. Are you satisfied that that merger is now solidly in place and that there are no hangover issues from it?
My view is that the merger is undoubtedly in place and complete. With the natural passage of time, people have come into the merged organisation, so those problems are much less acute than they might have been initially. On the other hand, as the section 22 report pointed out, a very important question for HES to resolve is the future of its important archive, which archive derives largely from the Royal Commission on the Ancient and Historical Monuments of Scotland.
Thank you.
I will move on to something slightly different—data breaches. The report says that eight data breaches took place, and, from our previous evidence session, I understand that three of those involved a member or members of the board. Can you bring us up to date on whether those breaches have been resolved? Are they dealt with? Are they over?
Historic Environment Scotland has some experience of data breaches, but historically not many. The number that arose in the summer of last year was a spike—in proportion to the size of HES, it was a lot. There were more than that, but eight were reported to the Information Commissioner’s Office. That is serious; I acknowledge that. That is uncomfortable, and the breaches need to be addressed. Two of the eight cases have been closed, and the remaining six remain open and under investigation.
Cyber risk has been on our risk register for some time, but, at the beginning of 2025, it was selected as an area for internal audit, given some increasing concerns. A paper was produced through that internal audit, which was carried out over late summer. There are two policies that govern data breaches at HES—one that covers the actual breach and one that covers the incident management when a breach has happened, including consideration of whether something should be reported and how it is then handled. Both policies have been reviewed, and lessons have been learned from that and will be actioned. The reports on both policies were produced late last year.
So, to answer your original question, six cases are still open and two were closed.
Was there a specific single reason for that spike? Did it derive from a single source, or was it just down to happenstance?
For the six cases that are being investigated, it is not possible to answer that question yet. Five relate to HR matters, with the subjects referencing senior leaders. It has been unfortunate that, over the summer, I have been a subject of many of those. Reputationally, that has damaged me personally and professionally, as well as HES. Any data breach that is in the public domain damages the organisation. We need to reflect on that and on how we restore credibility. We discussed that at the most recent board meeting.
There was one incident of unauthorised sharing of personal data, in which data was sent outside the organisation, and there was another incident involving the transfer of sensitive data without having appropriate arrangements in place. There was a combination of factors.
In relation to the two breach issues that have been resolved, I assume that there have been no penalties for HES.
No.
I will move on to one last question, which is about single-source justification. Contracts were offered for items over £1,000, for which there should have been three quotes. Apparently that took place on at least one occasion. Was there more than one occasion? I have here a reference to one occasion on which that happened. Have other contracts been issued on that basis that we have not been sighted on?
12:00
I will take that one. There are potentially two issues there.
First, there is the single-source justification itself. That is a known procurement route that allows an organisation to engage with one supplier where there is no alternative. We come across that in our normal operations. We undertake some specialist activities and it would not be unusual, in particular in some remote and rural areas, for a direct contract with a supplier to be the appropriate route where there are no alternatives that would provide three quotes.
The other thing to which you might be referring concerns the £1,000 and three quotes in relation to e-procurement cards.
Surely there should be a policy to deal with the situation that you describe. I can understand that, in a rural environment, there is limited capacity to be able to go out to the market and ask for quotes, but surely there must be something in HES’s policy that would cover that point. That would make it not an irregularity but simply a transaction that is processed in accordance with policy.
Indeed—the procurement policy is the overriding policy. It is very clear within HES, and in legislation, how procurement in the public body works: at which point we use three quotes, at which point we go out to tender, and so on. The policy has been reviewed by our internal audit process as part of the reflections on the section 22 report and the audit report, but we have also looked at the SSJ policy specifically, and at not only how those justifications are signed off in the first place but how they are tracked afterwards.
So, at the time that the breach took place, it was really a breach resulting from the lack of a policy being in place to cover that.
No—the policy was in place. If you are referring to the use of e-procurement cards, it is on the record that, in the case of the kitchen, for example, the procurement policy was breached in that instance, where three quotes should have been obtained. There was a separate instance where an e-procurement card was used to pay for goods, which involved a separate policy, but the procurement policy should have overridden that.
Okay. I think that colleagues will pick up on the cards.
Could I act as a little bridge between Mr Beattie and Mr Simpson? You were asked about how long this had been going on. Ms Brown, you arrived in September 2024, so you cannot really speak for before that date.
We know that these 400 electronic purchasing cards presumably existed before that date. I am looking to the Scottish Government here, really. We know that the complementary tickets policy presumably predated September 2024. Did you not flag up any concerns about the existing procedures that were in place? That question is for either Mr Hogg or Ms Riach. Do you think that they would have pre-dated Ms Brown’s arrival?
My understanding is that the number of electronic purchasing cards in circulation in the organisation pre-dated Ms Brown’s arrival. I do not know whether the Scottish Government was aware of that at the time. It was not necessarily the wrong thing to have happened, but the Auditor General has called out the lack of scrutiny around the use of those cards. He comments, for example, on the level of sampling of transactions to be reviewed.
To the best of my knowledge, the first that we were aware of there being lax procedures around the use of those cards came with Ms Brown’s arrival in the role. She began calling out issues that were less visible, which were in the category of poor practice.
I will briefly return to Mr Beattie’s question, which was about procurement. There are two separate issues in that regard. One is the issue of the use of the electronic procurement cards, which we have just been discussing. The other issue, which the Auditor General referred to in his report, concerns a specific instance of multiple single-source justification contracts being given to the same individual. That may or may not have been done using the cards, but the point is that it involved several tens of thousands of pounds, and was a clear breach of the existing HES policy on procurement.
At that time, there was a clear procurement policy in HES that should have prevented multiple contracts being given to a single provider of services without competition, and the Auditor General called out an instance where that did not happen. I think that I am right in saying that three such contracts were given to that one individual and that, together, they added up to approximately £60,000 or £70,000. That is a serious matter, and I know that HES appointed the head of internal audit to carry out an investigation into that circumstance. We saw a copy of the draft report about that, and we asked further questions about the action that was being taken specifically in relation to that example.
I wanted to be clear about that, as I think that the Auditor General might say that the electronic procurement cards are an issue but that there is also a specific instance of the single-source justification not being applied appropriately.
Thanks for clarifying that. Mr Simpson will ask some questions about that issue but, before he does so, I must just say that I think that 400 e-purchasing cards is rather a large number for a permanent workforce of 1,600 people—Ms Duthie told us in evidence that she thought that it was a high number. I recognise that those 400 people may all be honest and be complying with all the rules and requirements and so on, but it seems like a huge number of people to have electronic purchasing cards on behalf of the organisation. Do you agree?
Yes, and I think that that was also Ms Brown’s view when she took up her post.
Ms Brown was right on that, certainly.
I invite Mr Simpson to come in.
There is a lot to pick up on. Has the number of cards reduced from 400?
The number of cards is still in excess of 400, but 35 have been removed recently, because they are not being used.
So, there are still more than 400, even though everyone seems to accept that that is too high a number.
That is correct.
Or maybe you do not accept that?
I will just give you a little bit of context. The fact is that Historic Environment Scotland is unusual in public bodies in being present right the way across the country, often in quite remote areas, and you would expect a higher use of electronic procurement cards in an organisation with that kind of function than you would if the organisation operated only in a city. I am not saying that 400 is the right number, and I am not saying that it is not too much, but I think that we need to recognise that there are some special things about HES, and one of them is that it is very often active in places where it is important that people are able to buy a meal, for example, or that they are able to buy whatever it is that they need using an electronic procurement card.
I am not disputing that there should be some electronic procurement cards, but Mr Hogg reckons—and I think that he is right—that 400 is too many. If there is an acceptance that 400 is too many, are you going to tackle that and reduce the number?
As my colleague has just said, we have begun to tackle that and have already reduced the number.
There are still more than 400, so you have not tackled it.
The work to examine the use of the cards is on-going.
An internal audit report that is now complete makes a number of recommendations for electronic procurement cards. One recommendation is to review the needs of individuals, and there are many other helpful recommendations, such as examining the limits that different people have and introducing approval for increasing limits.
We have also learned that we have slightly unhelpful overlapping policies that have created some confusion for staff, which we are looking to fix. For example, we have a separate policy for travel and reimbursed expenses and for procurement. There is a question about when someone would use a card. I would say that all these things are opportunities to provide clarity for staff so that the policies are used properly.
I am going to ask about travel, but I want first to pick up on something else that Mr Hogg said in relation to cards. I do not know, and I do not think that the committee knew, that a single contractor had been awarded jobs amounting to £60,000 to £70,000, which was in breach of policy. Those jobs were not put out to tender. There is a reference to that in the Auditor General’s report, but it does not say that only one contractor was awarded the work. That was news to me. What field was the contractor in and what were they contracted to do?
I can answer that for you. It is not about cards; it is about the inappropriate use of the SSJs. My understanding is that that contractor was effectively a temporary resource and a temporary employee, which is an inappropriate use of an SSJ for procurement. The procurement process should have gone through preferred suppliers, et cetera, in order to obtain resources if they were required.
What was the temporary employee doing?
I believe that they were in our marketing and events directorate. I am unsure of the exact role.
So, they were essentially hired to do marketing, whereas you could have put the work out to the market and potentially found someone else.
The appropriate procurement route would have been through an approved agency supplier from the framework agreement. The resource should have been recruited through that.
Ms Brown, I want to go back to the start. The convener was exploring your work when you first started and the things that you uncovered, including purchasing cards, travel expenses, data protection failures and a big alcohol bill from a leaving do. What was the board’s response to your finding out about those things?
At a high level, I reported the general findings in November in three buckets, which, at the time, were culture, operations and governance. That was about eight weeks into my post. At that stage, they were early observations on general things. The feedback at the time was some recognition that those problems were not new. There was some focus on what would be done. I was serious about it and, in some cases, the board papers are quite detailed about those findings. That triggered a series of internal audits. There was additional scrutiny at the audit and risk assurance committee, which has a special focus on controls and risks and is a subset of the board. The committee was keen that we progress reviews of those areas, which we did. That was in the first three months of my appointment.
At any point, did you start to feel that people were unhappy with what you were finding out?
Yes.
How did that transpire?
There were various levels of frustration. Some board members were keen that we move on and resolve the issues quite quickly. Others saw the issues as operational and not a matter for the board, while others felt that we should move on and focus on bigger or different things.
Did you come under pressure to stop delving?
12:15
I carried on doing what I started doing. I shared findings with the chair in one-to-one meetings as well as through the sponsor team and had meetings with the director and various levels of people in the sponsor team to understand whether those were new issues and to sort of sense-check them. I spoke to more and more staff across the organisation to make sure that they were not one-offs and to understand whether there was a pattern or theme, so that I could be as fully informed as possible. I also talked with the chair and the board at regular intervals.
Did anyone ask you to stop?
Nobody asked me to stop.
Was there any kind of pressure put on you to stop?
There were discussions around board agendas, particularly in February. By that time, I had had four or five months in post and it was clear that there were some things that I felt needed to go to the board for approval because they met the criteria to be taken to board. Typically, board meetings were quite short and fairly light, so I was proposing an agenda that would be longer than normal. That was a challenging conversation because it was not within the norm, and that was evidenced by my team. I had a chief exec’s office team that recognised that what we were proposing was something that was not quite within the norm.
Okay—you wanted a longer agenda. What items did you want on that agenda that other people did not?
One item that I remember quite clearly was governance training, in the form of a general session that would be facilitated, internally or externally, to help clarify roles. I made an observation—this picks up on a point that Mark Jones made—about culture and the need to understand the role of the board, including the role of trustees, directors and the leadership team, and indeed the chief executive and accountable officer. I was keen to provide clarity to everybody on what the respective responsibilities are, and a governance session was one thing that I was keen to do. I understand that plans to have that were cancelled a number of times, but that it has now been delivered under a new chair.
In May last year, you went to your doctor. Was that work related?
Graham, I think that we have established that it was. We should move on to your substantive—
The answer is yes, then.
I think that that is what we established earlier on. I think that we need to move on to the travel issues and so on, not least because of time.
I thought that it was quite important to establish that, but I will move on. It was work related. Are you okay now, Ms Brown?
Yes. I sought—it was my intention to return to work in July, and I am back at work now.
Yes—as you have said earlier, you wanted to come back and you were prevented from coming back. You are back now.
I want to look at some of the things that you uncovered. One was the issuing of complementary tickets to events, which were dished out, I think, to HES staff. Other people would hire venues for events, and HES staff would get those tickets. Do you know what the scale of that was and what kind of events they were?
Obviously, the commercial operations of HES involve utilisation of the assets in terms of events at the properties that are in our care. The tickets referred to in the audit report and the section 22 report relate, I think, to events at Edinburgh castle, specifically the tattoo and associated concerts during that period on the castle esplanade. As part of our contractual arrangements with the Royal Edinburgh Military Tattoo, the organisation receives 10 tickets for each night of the tattoo and either 10 or 20 tickets—I might need to be corrected on that—for each of the concerts, and those tickets are used by the organisation to host partners et cetera as part of normal events hospitality.
It is worth stating that, in the normal world of a public body, such events would be unusual or would never happen, but HES is in a very special position in that it has a very commercial operation, too, and those things are part of commercial business. The audit report, though, highlights some potential issues with how those tickets have been used and whether the guests invited were appropriate, and I am personally sponsoring an internal audit review of how those tickets are acquired and distributed among the organisation. That review commenced as of this week.
Okay. In the interests of time, I will move on.
When I asked about foreign travel in a previous meeting, we were given a few interesting examples. In one example, somebody was sent to teach traditional skills in America, and there were some digital round tables, which were also in America. However, the one that piqued my interest was the study of mortar in Norway. What was the justification for that?
I can give you some context to travel spend, because it might provide some helpful background.
HES spends around £140 million a year, and it spent £37,000 on travel this year and around £40,000 the year before. Overall, then, we are talking about a very small amount of public money. If you look at the very broad range of HES activities from archaeology, research and heritage skills all the way to more commercial fundraising and philanthropy activities, you will see why many people will make a case to travel—and, I should say, many more than actually do. We have a policy in place that anything over £1,000 comes to the chief exec for approval, and I have reviewed many cases in my time there.
It is a very small amount of spend, and I think that we should also consider that some of those trips are supported through grants—grant funding pays for them—and there are cases, too, of trips being reimbursed by the host in the countries in question. On the more commercial side of things, the trips do generate income. We have digital assets that people can acquire; we have made trips to promote them, and the income that they have generated has been considerably in excess of the cost of the trip. That is published in our accounts.
I presume that somebody going to study mortar in Norway is not going to generate any money.
I do not know whether that generated money, but what I do know is that Historic Environment Scotland has an international reputation for the quality of its work on historic buildings, and lime mortar is obviously one of the essential materials used for the restoration and refurbishment of such buildings.
I happened to look at that particular example. I know that it sounds improbable, but apparently the Norwegians have a particularly good way of using lime mortar, so the person went in order to find out how they did it.
There you go. It is good to know that the trip helped.
Yes.
So, that is your answer.
It was a trip not to earn money, but to expand expertise.
Okay. That is fine.
Finally, we come to the leaving do—the infamous leaving do—for a board member. Eleven people went. It was at a restaurant attached to the University of Edinburgh and the drinks bill was £500, so that was about £45 a head—it must have been a good night. All the people attending were asked to repay that money. It was inappropriate, but there have been other instances where people have racked up booze bills on the public purse. Has all that stopped now?
I can talk generically rather than about those specific cases. I am not aware of any further such incidents.
Have you stopped it? Have you issued an edict to staff that they are not to do it again and that, if they go out, they have to buy their own drinks?
We agree that the instance you referred to was inappropriate and it has been dealt with. I refer to my previous comment about HES’s unique structure. In a public body, expenses and spending money on alcohol is not acceptable. Within the events and hospitality business, however, it would be reasonable to have a small amount of alcohol in a hospitality environment. We need to be careful that we do not put a hair shirt over the opportunity to generate income in support of our heritage assets.
Thank you. I have taken up enough time.
Joe FitzPatrick has been waiting patiently to ask some final questions.
Thank you, convener. I want to touch on an area that we did not manage to cover at the previous meeting. The archive house project was started in 2021 and a decision was taken in June 2024 to end it. It would be good to hear how much has already been spent and how much more will need to be spent before the lease break in 2029.
The lease was signed in 2019 with a break at 10 years in 2029. When the lease was signed, the project had not commenced. It was a building that was identified for archives. The business case for the project was then developed and that was approved by the board in 2021. Development work then took place over two to three years and the costs for a variety of suppliers and development work amounted to about £2 million. There was some further work still to be done, so the cost went to around £2.9 million.
At that point, the estimate for the project costs, which started at around £9 million, were looking more like £20 million to £25 million, so it more than doubled. There was no funding in place for that estimated cost, so in July 2024, the board decided to abort the project to avoid any further costs. I do not have the exact number, but there is a still rental lease going on. At the same time, we are considering what the building could be used for in the remaining period of its lease.
So, work is still being done on what the building could be used for going forward. You have made a compelling case that a sum that was significantly more than expected would have had to be spent to bring the project to fruition. What was the governance and transparency around making that decision?
One of the things that we are concerned about is what happens with these significant decisions. However much money was saved, you are telling us that circa £3 million has been spent and it is not recoverable. There is a need for transparency around that, so I would be grateful for any thoughts on that.
For a project of that size, scale and nature, I would expect a board to see a full business case both for development and for aborting and pausing. I know that that was not the case in the summer of 2024. However, we commissioned a lessons-learned internal audit review. Its report has just been published and will be presented and discussed at the audit and risk assurance committee later this month. It contains many recommendations relating to project management, governance, reporting and discussing options, which were missing as part of that project. That will come later this month, and we are happy to share that report.
12:30
My next question is for Kenneth Hogg or Shona Riach. Was the Scottish Government aware of the decision making around that issue and of the business case?
To highlight the point that was made by the Auditor General, in addition to the issue of whether the decision to go ahead with the cancellation was correct, it is the governance of that decision that was the key issue. In June 2024, the executive leadership team—the executive leaders, not the board—decided to cancel the archive house project, and the section 22 report says that
“the board was not provided with a paper to enable them to scrutinise the proposal”.
As I say, the key issue is as much to do with the governance around the decision-making process as it is to do with the value-for-money case for proceeding. However, that predates my involvement, so Shona Riach might be able to add something.
My recollection is that the work on the archive house had been going on for a number of years and the sponsorship team were certainly involved in that. However, my understanding is that we were updated on the decision after it was taken, rather than before the event.
What action did the Scottish Government take? Were you aware that that big decision had been taken by the executive team without the agreement of the board?
My recollection is that, as soon as we were aware of the decision, we raised concerns about it on very much the grounds that you have set out, regarding the amount of money that had already been sunk into the project and the fact that a solution needed to be found for the archive issue, which meant that that was something that we would need to come back to. It was, therefore, something that we discussed.
It seems strange that a decision of such significance was able to be made without the approval of the board. Can the executive team still operate without the approval of the board at that level?
Just to be clear, the board approved the decision to abort the project—it was the board that made that decision. However, I accept the Auditor General’s comments that the decision was taken without a sufficient business case review at that point.
I appreciate that it was before your time, Ms Riach—and before yours, Sir Mark—but it seems that the board was prepared to make that decision without a business case. Is the board entirely new, or are some of the board members from that time still there? What is the ratio of former members to new members?
Most of the members post-date that decision, but a couple were on the board at that time.
So, it is mostly new members.
New or new-ish.
New since 2024, is what I mean.
Yes, the majority of them are new since 2024.
Maybe two would have been there in the period from 2019 to 2022 but, since 2024, there have been two new board members.
A key point is that, since the appointment of Sir Mark, the Scottish Government has worked with him to appoint two additional members to the board specifically to bring in skills and experience that he and we agreed were lacking on the board.
That is appreciated. However, from my perspective, and perhaps that of my colleagues, a large number of board members were not exercising their roles in the way that we would have hoped. Has there been additional training? Since you have come in and appointed two new members, have you made sure that the rest of the members of the board understand their responsibilities?
Yes, I have. However, it was quite unacceptable that the board was put in a position in which it felt that it had to make a decision when there was an inadequate basis for doing so. That is what happened. The board made the decision, but they did not have the appropriate papers or the appropriate length of time before the board meeting to take a proper, fully thought-out and rational decision. The decision to abort the project was absolutely right, but the way in which it was taken was not.
It is about getting that confidence, and one thing that is helpful for that is transparency. Are the board papers now being published? Are the minutes being published?
Yes, the minutes are placed on our website. There has been a bit of a backlog, but all of them are going up.
That is appreciated. It is helpful, and it will give more confidence to the organisation going forward and help it to be successful, which is what we all want. Thanks very much.
You mentioned earlier that an organisational and cultural review has been commissioned and scoped. We look forward to seeing the outcome of that. Whether it will be the members here who see that outcome remains to be seen, but it would be useful for us to be kept up to date on it.
We are also aware that the Constitution, Europe, External Affairs and Culture Committee of the Parliament has been taking evidence from you and looking at what has happened with the findings of the Audit Scotland report, so we will liaise with that committee to see how we can assist it in its work.
For the time being, I thank all the witnesses for coming along this morning and being open to giving evidence to us. I thank Shona Riach and Kenneth Hogg from the Scottish Government. I thank Mark Jones, Stephen Uphill, and particularly Katerina Brown, from Historic Environment Scotland, for being open and willing to answer our questions. That is much appreciated.
I move the committee into private session.
12:37
Meeting continued in private until 13:02.