Official Report 594KB pdf
10:32
Under the fourth item on our agenda, we will take evidence on Audit Scotland’s annual report and accounts for the year to 31 March 2026 and the auditor’s report on the accounts. Members can find copies of those documents, as well as a management letter from the TC Group, in paper 2 of their meeting papers.
I welcome Colin Crosby, the chair of the board of Audit Scotland; Stephen Boyle, the Auditor General for Scotland; Vicki Bibby, Audit Scotland’s chief operating officer; and Waqas Sanawar, Audit Scotland’s head of finance.
I understand that this is the final meeting of the commission that Colin Crosby will attend before his term of office ends. I express the commission’s thanks to him for all his hard work during his term in office.
I also put on the record our thanks to Andy Munro, Audit Scotland’s head of internal audit, who has been an adviser to the commission over the past few sessions of the Parliament, for all his help and support.
I invite Colin Crosby and the Auditor General to make short introductory statements.
Good morning, chair and members of the commission. Thank you for your kind words. I was hesitating about whether I should say “chairs”, but I will restrict it to the singular.
It is great to have the opportunity to speak to the commission about our performance during 2025-26. Before I do so, I congratulate you all on your successful election to the Parliament and, indeed, to the commission—I hope that you will all see that as worthy of congratulation.
Audit Scotland and the SCPA have had a strong and productive working relationship for many years, which I believe has been built on mutual respect for the importance of open, fair and independent scrutiny of Audit Scotland and an understanding of each other’s roles and aims.
At a time of sustained and significant pressure on public services and finances, and a clear agenda for major public sector reform, the role of public audit has never been more important. It must not only provide assurance but make a clear and positive impact. During the past year, we undertook an in-depth evaluation of that impact. The mid-term review of our purpose, “Public audit in Scotland”, confirms that our work makes an important and valued contribution in supporting improvement in public bodies and parliamentary scrutiny of around £60 billion of public spending. However, we recognise that we need to do more to create better understanding and to demonstrate our impact and the increase thereof.
Although delivering impact now is essential, we are equally focused on the future. We have an ambitious programme for transformational change under way, which looks at the scope of audit, how we deliver it and the shape of Audit Scotland. It will ensure that our work remains proportionate, efficient and responsive to technological change, with the right skills to meet emerging challenges. During 2025-26, we laid key foundation stones for that transformation. We are building on that in the current year to ensure that we deliver our long-term ambitions.
At the same time, it is quite right that, in the light of the recent programme for government and other moving external circumstances, we reflect on our direction of travel to ensure that it is where public audit needs to go. I believe that we are on the right path, but I know that my colleagues on Audit Scotland’s board and executive team will constantly review and monitor that as we progress.
As you mentioned, chair, this is my final report as chair of our board before leaving post at the end of the month. I acknowledge the strength of the organisation: Audit Scotland is trusted, respected and increasingly well understood. That is testament to a board that provides strong governance and constructive challenge and, most of all, it is testament to the dedication and integrity of the Audit Scotland staff. On a personal note, it has been a tremendous privilege to be a board member and, latterly, chair of Audit Scotland, which is an organisation that aims to be an exemplar public body: efficient, effective, independent and, importantly, forward looking.
Thank you. I will hand over to the Auditor General.
Thank you, chair. I echo Colin Crosby’s congratulations to you and the vice-chair on your appointments. I and my colleagues look forward to working with you in your roles as members of the SCPA.
It is not quite the end of my term, but it is worth noting that my term as Auditor General for Scotland and as Audit Scotland’s accountable officer has around 20 or so months remaining. I very much look forward to engaging with the SCPA during the remainder of my term in those roles.
Colin Crosby has set out some of the context for our work, but, if you are content, chair, I will say a few additional words and touch on some of the content of our annual report and accounts.
Public audit brings a unique, whole-system perspective to the performance of public bodies and their public spending. In our view, public audit is a fundamental cog in a modern democracy, through its role in providing independent, objective and robust scrutiny and in supporting the Parliament to perform its oversight of the services that the people of Scotland rely on. In recent years, Audit Scotland and many other organisations have helped to sharpen the focus on the sustainability of public spending and public services and, in and among that, the need for public service reform.
As we have all seen, over the past few weeks, the programme for government has set out an ambition of reform at pace and scale, as well as its prioritisation. Through our work, we have noted public service reform in the context of major structural, fiscal and demographic challenges and changes in Scotland. Our public services continue to operate under fiscal pressure and, through our audit work, we have consistently identified risks to long-term sustainability, the implications that those risks have for public services and the opportunities among them.
Addressing all of that will require sustained and co-ordinated action and, in particular, a stronger and clearer focus on long-term fiscal sustainability and a move from short-term approaches to medium and longer-term system-wide planning, multiyear funding and an alignment of priorities, resources and delivery.
Audit Scotland as an organisation faces pressures caused by tightening of the public finances and increasing demand. Over the past year, we have taken stock of our impact and of how we are preparing for the future. We have made progress in shaping that, including what the future public audit model for Scotland might look like. We have modernised our audit approaches and our operating model, which has included preparing to harness the opportunities and, importantly, to manage the risks arising from new technologies, particularly artificial intelligence. We are clear about the need for fiscal discipline and efficiencies today, and we ended 2025-26 with a small operational underspend.
As Colin Crosby did, I record my thanks to my colleagues in Audit Scotland and to the audit firms that we contract with for the professionalism and dedication that they have shown throughout the year. My colleagues are fundamental to the value of the work that public audit delivers in the public interest.
Colin, Vicki, Waqas and I all look forward to answering your questions.
Thank you, Auditor General. I will begin with some questions specifically about risk management. What are the three most likely risks for Audit Scotland in the next year or two? What causes greatest concern to the board and to your executive team?
I am happy to start before bringing in Colin, who has a perspective on the board’s role, and particularly that of the audit committee, and on how our governance oversees risks. Vicki Bibby and Waqas Sanawar might want to say something, too.
The top two risks in Audit Scotland pertain to cybersecurity and are about the likelihood of a cybersecurity attack and the preparations aimed at avoiding that. Alongside that, we have arrangements in place to recover from such an attack.
Our dedicated and experienced information management colleagues have hammered home to the executive team and the board the message that we should be anticipating and preparing for a cyberattack. The language is about “when” and not “if”. Members will have seen the impact of cyberattacks on commercial organisations and public bodies, and I have reported to Parliament on the impact of such attacks.
Those are the top two risks for Audit Scotland. Like many organisations, we deploy risk management arrangements and use red, amber, green ratings. The risk is always set at red, despite the mitigating actions that we identify. For perhaps obvious reasons, given that we are in public session, I will not share what those mitigations are, but there is a clear and present risk to our organisation and to the delivery of our functions.
You asked what might come next. It is not that I am racking my brains, but there are a few competing risks for that top spot, including the management of our finances and the experience that we give our colleagues In Audit Scotland. Some changes are also coming through, with changes in the audit market and to regulatory arrangements, and we also consider quality and reliability.
I will hand over to Vicki and then will briefly bring in Colin Crosby.
As the Auditor General said, we have a robust risk management process in place. Two weeks ago, the audit committee took a deep dive into our top risks and looked at our risk appetite. We did that to challenge ourselves on which risks we want to mitigate downwards and which we want to operate up to, particularly in the light of the transformation agenda and our future planning.
It is important to strike a balance. Fundamentally, the quality of the public audit is vital for trust and for our independence. As will be discussed later, we have quality arrangements and we monitor our quality and, as Stephen said, our resources closely.
We are on a transformation journey, as many organisations are. We need to ensure that we are delivering what we need to now and that we are looking to the future. We need to take our people with us and ensure that they feel that they are supported. Significant change is coming in the audit profession as a whole and to the organisation as we look to ensure that we offer value for money and are as efficient and impactful as possible. Those are our key risks, which we need to speak about actively at the board and audit committee, and as an executive team.
10:45
I will move on to delays to audit completion. Page 8 of the annual report and accounts, which you have provided, states that you
“continued to work on recovering audit delivery timelines against our internal targets, following disruptions, truncated timelines and new auditing standards in recent years.”
What are the specific reasons for the continuing delays? What risks are there to public confidence in the audit of our public bodies?
As a starter, I would say that we are not yet where we want to be with the delivery of annual audits of public bodies. I will give you some of the history. I am reluctant to reference Covid, but it is relevant, because it significantly disrupted the completion of annual audits. Since that period, we have been on a recovery programme. The intention was that we would have recovered by the end of our current five-year cycle of audit appointments for public bodies, which would take us to the end of 2026-27, and there has been progress inside that figure. For example, audits of NHS bodies and further education colleges have almost all been done by the internal target deadlines. However, local government and central Government bodies are more challenging. Some local government bodies are behind in the preparation and audit of financial statements, and some central Government bodies are in that bracket, although the situation is not as severe.
I will share two pieces of information with the commission. Our expectation is that we will get to 75 per cent completion next year, and we hope that we will nudge towards 80 to 90 per cent in the year after. The completion of an audit is a partnership. In order for auditors to audit financial statements, public bodies have to prepare them, and they must be accompanied by clear, detailed and comprehensive working papers, so that auditors can interrogate the system. There is a combination of factors. We do not resource to allow for much flexibility in the timescale, and, if a public body misses its slot, as it were, that can have a knock-on implication for the completion of various other audits. We work hard and I effectively communicate my expectations to auditors in public bodies and those of the Accounts Commission to local government.
We think that there is a positive trajectory towards completion, although I would not want to leave the commission with the impression that we are content with where we are. We are actively working to and managing timelines, and we are engaging locally with audited bodies and auditors, and escalating when we need to. I assure the commission that we are treating our recovery as a priority.
There is a piece about the apparent delay that is worth dwelling on. Two thirds of the delay is caused by external factors along the lines of what Stephen Boyle has outlined. It is a slightly strange argument to make, but, as a board, we get terribly concerned when we slip behind our internal framework. That does not mean that the work is late in terms of the statutory delivery timelines, although a small percentage of projects are. I make that point because it touches on the risks that you spoke to in the first item in that timely audit work impacts the relevance of our work. The board is concerned with being relevant and that work is done timeously.
That leads to a risk that I will add to the couple that have been mentioned, and that is reputational risk. If Audit Scotland does not have a first-rate reputation, we will not have the same impact either with those who are involved in all matters Holyrood or with the public at large—who are, in some ways, a major stakeholder.
Thank you. You have highlighted a bit the process for external organisations that are preparing for an audit. Given that many organisations will be going through that annually, have you put it to them that the new process will make it easier for your auditors to see the information that you are telling us is sometimes not prepared for them to access?
Yes, very much so. Vicki Bibby can say a word or two about that. Perhaps she can set out for the commission what auditors proactively do for public bodies in a steady state, and also what happens when things do not work.
We have been doing a lot more work with audited bodies on what the expectations are. As Stephen said earlier, it is a partnership. We are running a project at the moment to engage on that extra level of detail and how that links to extra fees—which someone might want to raise later. It increases transparency about the fact that, if an organisation is not ready, that will have a consequence, and about why that is.
On the controls that we have around that, delivery is taken very seriously. However, it has to be weighed against quality, because we need to ensure that delivery to a target is not the primary objective. Auditors are signing off an audit in their own name, so they need to know that they have delivered it against the quality standards. That is a driver.
The figure that we have for late audits is quite stark. However, when we look underneath it, we see that some of them are just days or weeks late, for reasons of audit committee timing and things such as that. That is why we work with the audited bodies to ensure that their governance is in place. However, other audits are very late. We have an escalation process with the public bodies that is quite transparent about where we want to intervene. The same goes for the Auditor General, as well as for the Accounts Commission, particularly in some areas of local government. We are working with the auditors and the audited bodies to get things back on track.
Kate Nevens has a follow-up question.
A key change that you are proposing is to take a more proportionate approach for smaller bodies. Can you tell us a little bit more about that and how it relates to supporting public bodies to be ready for their audits?
You are right in saying that that is one of the hallmarks of the future public audit model that we are proposing, together with the code of audit practice that the Accounts Commission and I consulted on extensively and published a few months ago. That proposed approach recognises that Scotland has public bodies of a wide range of sizes and scales, from the Scottish Government, very large health boards and councils to, at the other end of the spectrum, some tiny public bodies with a very small numbers of employees and small finance departments.
Although our approach has not quite been that an audit is an audit, it has perhaps been based on the accounting framework that public bodies are required to use: local government bodies have to follow local government accounting codes and central Government bodies follow the Scottish public finance manual for their preparations. We felt that, as an organisation, we could bring a more proportionate context to how our audits work. We engaged widely, particularly with the predecessor Public Audit Committee, to reassure people that we will still be carrying out audits but under a different auditing regime. That regime is satisfactory and robust, but it is less onerous for small bodies than the international standards on auditing.
We set a financial threshold so that there is clarity for public bodies. If an organisation sits below a given turnover level, we will take what we think is a more proportionate but still robust approach to its audit. It is a fine balance, but it recognises that size and scale are relevant to the context of what an organisation can cope with in its preparation and its audit. That approach will come in as part of the new audit appointment arrangements in the current cycle.
That is helpful. Thanks very much.
I will open up the session to questions from other members. I invite the deputy chair to come in.
I have some quite general questions. I am interested in the fact that, although so much of your work looks specifically at the numbers, you clearly review policies as well. You have set specific themes when looking at best value in local government. How do you measure best value under the various topic headlines, and how do you follow things up? In 2025-26, the theme was transformation, so councils will have done work on that in year 1. What is the continuum in subsequent years? Given the focus on public service reform, that is likely to be a significant area.
Audit Scotland provides audit work for the Auditor General and the Accounts Commission. The Auditor General has a wider remit and, in local government, there is the additional focus on best value work. The Accounts Commission has been looking at that in detail as part of our future audit model. Best value aspects have changed over the years, and there is a proposal for them to change again. It used to be the case that, over a cycle, every council would receive a detailed best value review. Without wanting to sound flippant, it was a bit like the best value bus coming into town and carrying out a deep-dive audit. It was felt that a more continuous approach was needed.
As part of their annual audit, all councils now have a best value review, and the controller of audit will produce a deep-dive report once during the five-year period. The Accounts Commission and the Auditor General have been considering recommendations, because, particularly in local government, a number of very similar recommendations are made repeatedly, year after year. We are doing internal work on the focus of recommendations, making sure that they are specific, measurable, assignable, realistic and time bound—SMART—as well as manageable, so that the response is not simply ongoing and there are clear actions. We are doing that in the interests of being helpful. The Accounts Commission is also looking at how it can change its work programme to follow up those recommendations in more detail.
The Accounts Commission is looking at a more risk-based approach to best value being part of the future public audit model, drawing on some of the benchmarking framework that was developed by the Improvement Service. That involves focusing on councils where there are greater concerns about financial sustainability or other issues. The controller of audit will base their work on that more risk-based approach.
It is not for me to speak on behalf of the Accounts Commission, but it is actively looking at this. Again, the principle that we are adopting is: what has had the greatest impact? How can we help? What has the Accounts Commission been doing when it has undertaken a specific best value review of a council? What lessons can be learned for the sector as a whole, such as those relating to financial management and ensuring that section 95 officers are properly resourced? It is looking at all of that.
I am very aware that councils across Scotland are of all different shapes and sizes. One of the important things in the programme for government is the observation that some local authorities are too small to be strategic and others are too large to be local. I would argue that, in addition, some tick both of those boxes. A transformational initiative in one council might not work in another. Do you have examples of transformation having been spotted in one council and transferred to another?
Perhaps we can provide that as follow-up information after the meeting. The Accounts Commission has produced specific reports, and I would be happy to share some examples. I do not have them to hand—apologies. However, the Auditor General and the controller of audit have undertaken specific work to identify lessons learned when, for example, one council has implemented a new accounting system.
11:00
The Accounts Commission is very focused on the fact one size does not fit all. It is trying to ensure that councils are deliberate in their decision making, and it is looking for good practice that they can share and consider in the transformation approaches that they take. I would be very happy to share specific examples of that in local government.
Thank you. I think that Kate Nevens has some questions about delivery.
Yes. I, too, have a question about best value. You mentioned a risk-based approach and the improvement framework, but your scope includes how well public bodies are using resources to improve outcomes for people. Will you tell us a bit more about how central people’s outcomes are to determining best value? How you are measuring that?
I am not trying to evade the question, but some of that is for the controller of audit and maybe the Accounts Commission. Its work is very outcomes focused. We had a strategy seminar with the Accounts Commission this week, which looked at the impact. It not only focuses on the processes that are in place; it looks for councils’ decision making and actions to focus on outcomes. I do not want to speak on behalf of the controller of audit, but I am sure, particularly given the work that she does, that she would be very happy to follow up for the SCPA specifically on what she is looking at in relation to outcomes and best value.
In your report there are figures from the review of the sample of audits that have been carried out through your audit quality framework. I am interested in the difference in completion rates between audits that are performed internally and those that are performed externally. It is quite a difference: 93 per cent versus 75 per cent. Have you any comments or thoughts on that?
I am happy to start on that and will bring colleagues in with anything further that they wish to add.
The chair’s earlier question was about risk. One of the biggest risks to us, as an organisation, is that of our work subsequently being found to be unreliable—if we individually, as auditors of public bodies, produce an opinion on annual accounts that is found to be incorrect or, more personal to me, if I produce a performance or value-for-money audit report and its findings are proven to be not as they are set out in the report.
In Audit Scotland, over the past six or seven years, we have invested heavily in quality management arrangements involving direct compliance that compares to international auditing standards, as well as broadening the usability of the reports and their subsequent impact. We do that through the two main means to which you referred. We have a contractual arrangement with the Institute of Chartered Accountants in England and Wales—before that, the Institute of Chartered Accountants of Scotland—to look at all our work and the audit work that firms undertake on behalf of me and the Accounts Commission and test it against quality frameworks and auditing standards. As you also referenced, we have an internal quality team, too, which tests that work.
You are right in saying that there are slight variations between them, but I, the Accounts Commission and the Audit Scotland board—Colin Crosby might want to come in on this—take assurance from the fact that both sets of results are reliable. We know that categorically, because we get our external reviewers to evaluate the work of our internal reviewers. Inevitably, it is a relatively small sample. It is reliable but it does not cover the totality of our audit work. The main message that I take from it is that our work is reliable—that auditors’ opinions are robust.
As an organisation, we are not seeing a set of results that suggests the need for significant improvements in auditors’ work. We are on a trajectory of improvement. I recognise that there will always be blips—things happen, because we are dealing with people—but there is a sustained underpinning of quality, both culturally speaking and with regard to the arrangements that are in place in the organisation.
I am keen to bring in Colin Crosby, because that is a strong focus for the audit committee and the board.
We will come on to the quality of audit under item 5, so we can perhaps explore that in questioning then.
The annual report demonstrates the breadth of the work that Audit Scotland does—the sheer volume of it—and the quality of that work. Notwithstanding that, you rightly recognise that there are areas for improvement.
On page 19, the report talks about some of the pressures that staff are under in producing reports—only 46 per cent of them feel that they have sufficient time and resources. You have recognised that that is an issue, because it suggests that 54 per cent of staff do not have sufficient time and resources. You have talked about taking a new resource management approach in order to improve capacity, which is key. The report also shows an upward trajectory in the average number of sick days over the three-year period from 2023 to 2026.
Would you like to expand on the issue of capacity and whether staff feel that they have enough time, and how the new resource management approach relates to that? To what extent is the number of sick days that staff are taking having an effect on your capacity to produce the volume and quality of work that you do?
I am happy to start, and I am sure that Vicki Bibby will want to elaborate.
The issues that you have picked out are all indicators of the health of the organisation and of our ability to do what we are here to do on behalf of the Parliament and the people of Scotland with the resources at our disposal and the experts we employ. We want to build careers for people, so that they can stay and develop in the organisation for many years. That is the case for most of our colleagues. We speak to our people regularly. We survey them and consult them, and we have appropriate line management arrangements to nurture people’s careers, so that they can perform to the best of their abilities.
I will touch on a couple of the points that you mentioned, and Vicki will be able to say more.
Although sickness absence is increasing in the organisation, the underlying trend is more to do with the fact that some colleagues are dealing with longer-term personal circumstances. We look closely at the data to see whether there is an organisational drift, but our absence numbers are driven by the fact that some colleagues are off in the longer term.
On the feedback from staff, two things can be right at the same time. According to page 19 of the report,
“46% feel they have sufficient time and resources”.
You are right—that implies that 54 per cent of people do not feel that they have sufficient resources at times throughout the year. Audits are pressurised. There is no doubt that, like everyone else in the public sector, we are operating with a finite amount of resource. Some deadlines are movable and some are not, and that can cause peaks in pressure at different points of the year.
I do not want to undermine or underplay that in any way, because it really matters. We could say a bit more about what we are doing about that. However, from a cultural perspective, 89 per cent of staff tell us that they are continually encouraged to deliver high-quality audits. We are trying to morph both of those aspects at the same time.
The resource management approach that you mentioned is a significant organisational development that we are undertaking so that we can deploy our people to different financial and best-value audits in a more sophisticated way than we did previously. The benefit that we are accruing from our investment in new technology is making a difference in the short period for which that has been in place.
I will pass over to Vicki to say more on those points.
There is probably nothing more to add on sick days. I assure the commission that we look at those figures in detail, because our remuneration committee is particularly interested in the fact that the trend is not going in the right direction, so we look at the granularity. Unfortunately, the position is a result of some staff having long-term conditions. Sadly, there has been an increase in things such as cancer diagnosis. We want to be, and are, very supportive to our staff.
On the capacity and resources issue, there is a fine balance with regard to maintaining delivery and quality, and supporting staff. Since Covid, we have been trying, in effect, to do 15 months’ worth of audit work in 12 months in order to get back on track. It is about finding the right balance with staff. At the same time, we are bringing through changes in the resourcing system to allow staff to be more agile and move across the organisation to where the resource is required.
Staff are signed up to that and they know that it is right. For a number of staff, that is just a change in the way of doing things. However, we have a number of staff who have been with the organisation for a long time. Although that is good news, and a positive indicator, it means that, in changing the way in which we do things, we have to ensure that people feel supported on that journey.
One of our big ongoing investments is in our new audit system, on which we have partnered with the National Audit Office. The NAO made the big investment, and we very much appreciate that it is allowing us to use its system. The system will take out a lot of repetition; it is much more automated and clearer on quality. The system requires us to input the things that a good audit requires, so that will help not only with quality but with staffing and resourcing.
Thank you. I am sorry to hear about the circumstances around long-term sickness absences in the organisation.
With regard to improving resource and capacity, do you take on audit apprentices? If so, is there an opportunity to increase them in order to build capacity?
Yes. We are very enthusiastic about the apprenticeship approach. We have routes in: traditionally, we take graduates and support them through the Institute of Chartered Accountants of Scotland. We have had a small number of school-leaver programmes, which we want to expand, as many organisations are doing. We are looking at taking on graduate apprenticeships, in which someone is studying for their degree and working at the same time. We also have core modern apprentices working in business support and communications and on the technology side.
We have just approved a role for a graduate apprentice on the technology and data side. We may come on to this—we are doing a lot of workforce planning about what the future auditor will be and what the requirements will be, and we are looking at what makes a generalist auditor and a specialist auditor and what data is required.
There are other routes for bringing in our pipeline, which we are committed to ensuring. As in a number of other industries, the advent of technology means that that pipeline is getting squeezed first in order to balance finances. We feel that we have a strong role to play in ensuring our wider public duty of bringing a pipeline of young people into the organisation and promoting strong financial awareness across the Scottish public sector.
I will add something on our people. We do regular people surveys; we have been doing the Best Companies programme, in which we run regular pulse surveys. Last year, we got a very strong result in Best Companies, which we really celebrated, so that aspect has been improving. People are under pressure, but they are also seeing the benefits of working in Audit Scotland.
I have some follow-up questions on the workforce. The report notes that training costs were underspent against the budget by £67,000. Can you help us to understand the reasons for the underspend and tell us a bit about how you are ensuring that that budget will be spent on appropriate training arrangements in the future?
The report also refers to diversity, equality and inclusion measures. Can you elaborate on how your DEI measures are going?
11:15
This might sound as though I am contradicting what I just said but, to balance the 2025-26 budget, we reduced our graduate intake by eight people. We still have around 50 graduates but, in that year, there was a drop in intake numbers. That gave us a pointer to make sure that the underspend does not become a repeating pattern. We do our training through ICAS and, in that year, there was a reduction in our training budget. That reduction gave us a prompt to make sure that there is not a trend in that direction—that is not where we want to go.
On the DEI measures, we are strong on gender and pay—we have moved into a position in which women have slightly higher pay, but the position is pretty equal. We are focusing on ethnic minorities, and recent statistics show that that situation is improving. We are looking at our recruitment process and working with expert organisations in that area to make sure that we are being as inclusive as possible.
We are conscious that we are performing significantly below the national average in our disability statistics, and we have been working to understand why that is happening. We have done a lot of work to ensure that people declare it when they have got a disability, in whatever form it may take, because not all disabilities are visible. We have introduced an employee disability passport scheme, which is voluntary. For example, if somebody is dyslexic and it is difficult for them to work with reports that contain tracked changes, they can say so on their passport. They do not need to keep repeating that if they move around to work with different managers. We are actively trying to ensure that we are as inclusive as possible, but we recognise that we still have a way to go, particularly in relation to our disability statistics.
We also have a reverse mentoring programme. My mentor has just qualified. They have a disability and they have been telling me how much they feel that they have been supported—and, interestingly, that their disability has resulted in a peak and that they would not necessarily go further. We do not think that that is the case, but that is how it is perceived. That is why we are actively looking for ways to be as inclusive as possible.
I can sweep up one or two points. The board is pretty content with the position in relation to DEI. In the vast majority of situations, our percentages are above the demographic ones for the particular issue. I suspect that disability inclusion will always be a slight challenge for us because of the age profile of our staff, which does not match the national demographic. However, we are conscious of doing absolutely everything that we can about that.
There is a situation that it is important to get. When we are looking at a broad suite of entrance points to training, we must be conscious that, regardless of their entrance point—the range of those can be as broad as you like—we must get people who can get to a particular level of professional skill. It will be even more important to achieve that if artificial intelligence takes on a base load of repetitive work. We have to get to a point at which the people we are taking in can get the judgment skills that are required and will be required in a context with AI.
I laughed—and I do not know whether I was crying—when I saw a contract that said that no output would go out without there having been human oversight of it. Never in my life did I think that I would see that term in a contract. That is a measure of the skill level that we have to get people to.
To come back to the point that Ms Nevens made about performance reporting and the fact that reaching people is at the heart of that, and bearing in mind that our performance reporting covers not only local authority areas but other areas, I note that the whole of Scotland report on general practice services is very much people and patient focused, so we very much think of where the output of the work is meant to lie.
Do you have any more questions, Kate?
I have a couple more if we have time.
Sure.
The report mentions that 91 per cent of your recommendations are being taken up—which is great—but that there is a slow pace of change at public bodies. Have you identified any recurring reasons for the slow pace of change or recurring themes around which recommendations are not taken up?
I am happy to start. It matters that our recommendations are accepted and we are happy that they are. However, you are right that the recommendations in the audits that we looked at are not being implemented at the pace at which we would want them to be, which feels really important. Our audit reports provide assurance, but the recommendations that are integral to them are designed to support sustained improvement, stronger controls and better assurance on public spending and public services.
We are doing a bit of work to consider what allows us to preserve our independence. I do not think that I would ever feel comfortable co-designing or co-creating recommendations. Auditors must preserve their independence; their recommendations are based on the work that they see. However, we think that there is probably space for better engagement with public bodies, so we craft realistic recommendations that can be implemented.
As auditors, we are all trained to be sceptical. To preserve that, we can sustain our impact beyond the completion of an audit through follow-up work. For example, yesterday at the Public Audit Committee, as some members will know, we discussed a follow-up report on post-school education reform arrangements, which is an example of our deploying quite significant additional audit work on follow-up and bringing in a further audit lens, although the original recommendations might not have been implemented. We can do that through the annual audits as well.
Although the audit recommendations are reasonable and make sense, ultimately we do not have powers to enforce the application of a recommendation, nor do I think that we should. It is for the public body to determine whether it wants to take forward our recommendations, depending on its governance and use of resources. I assure the commission that we are alert to and are looking closely at the issue and that some of our recommendations could go further than some of the statistics from the recent samples that we have had.
Do I have time for another question?
Yes.
This one is a little niche—apologies. I was interested to read about the work that you have been doing with the Scottish Human Rights Commission and the United Nations Human Rights Council. I am interested in hearing a bit more about the practical toolkit and how you feel that the human rights framework can strengthen your audit methodologies.
I am happy to start, but colleagues are welcome to come in, too. We have been deploying a human rights-based approach, particularly in our performance and best value audits, for a few years. Although one part of that work is to consider how we are performing as an organisation—we have appropriate outcomes along those lines, too—it is particularly about engaging and learning with others.
We held an event with the Scottish Human Rights Commission in the autumn last year to set out how we can work together as scrutiny bodies to, first, identify and share with public bodies any appropriate guidance or good practice about the application of public services and effective public spending and, secondly, to identify what we will do as organisations through our audit work.
Perhaps the strongest example of late that sticks in my mind is from an audit that we did on digital exclusion in the previous session of Parliament, which particularly looked at the pace of change of public services and the rapid adoption of technology. That will work for many people, but not for everybody. We need to ask how people’s rights are being preserved within the changing nature of public services.
Alongside that, we did quite a lot of auditing of social security in the previous session of Parliament, and we have a report on the Scottish child payment pending in the next few weeks. That will set out an understanding through our audit work of what human rights are and how they are being supported through the delivery of public services, and of where we come into that, too.
I have a question about the additional fees that are being paid to audit firms, which you touched on earlier. On page 34 of the report, you indicate that
“Fees and expenses paid to firms was £1.55 million more than budget.”
I am interested in whether that situation will continue, as well as what systems and processes you have in place to ensure that those additional costs represent value for money to the audited bodies and the taxpayers who fund them, because it is key that audit fees should be reasonable.
You are right that audit fees should be reasonable. Without going into the nature of the appointment model, the Accounts Commission and I appoint auditors—either people who work for Audit Scotland or people from six audit firms, following a procurement exercise.
The audit fee assumes a few things, including—as we touched on earlier—that the public body is ready to be audited and it has prepared a comprehensive annual report and accounts with the appropriate working papers. That happens most of the time but not all of the time. That is partly why some auditors have come to the view that additional fees are needed for time lost or for additional audit work, beyond what would be reasonably expected from an audit. I will bring in Vicki Bibby next to set out some of the scrutiny that we apply as the system leader for public audit in Scotland.
Fundamentally, the audit fee is agreed between the public body and the auditor. That is the relationship that exists. It is not for Audit Scotland to set what the additional fees should be. That consensus and agreement is what happens after discussion between the public body and the auditors, but it is clearly important for the auditors to set out to the public body—with a bit of granularity, if they need to—why there are additional fees.
There are also new standards and new compliance arrangements that come in, either from accounts preparation or from auditing standards, that auditors and public bodies have to follow. However, the extent to which the public body is ready to support the audit is the main contributor to additional fees.
We set the fee framework at the start of the appointment period, and everybody has their core fees. The appointment letters set out what is expected for a good partnership audit.
In relation to cases where additional work is required, the requirements of the profession have increased significantly over recent years, with all the compliance that is required, particularly on the balance sheet. That frustrates some public bodies, because a lot of the risk is potentially around some of the expenditure in the income and expenditure account but—and I am not saying that the balance sheet is not important—the auditors are required to do a lot of work on the valuation of non-current assets, for example, to comply with accounting standards. The audited bodies are aware of that, but if they do not have controls and systems in place, that requires extra work, which results in additional fees.
As Stephen Boyle said, those additional fees are agreed between the public body and the auditor. They will come to Audit Scotland—particularly if it is over a threshold, it needs to come to me to approve discussion happening. That is sometimes misinterpreted to mean that Audit Scotland has approved the additional fee. We are very aware of that, and we are doing work in the team to ensure that there is more transparency—as much as possible—on the fact that the agreement is between the audited body and the auditor.
11:30
We are working with auditors to ensure that they have those conversations up front so that there is an expectation, rather than their saying at the end of the audit, “Here are a lot of additional fees.” It is public money, absolutely, so it would be better spent on front-line services than on audit fees. However, we need to ensure the rigour and quality of public audit, and protect that, in order for an audit to be signed off.
On the future of the public audit model, we are looking at what the requirements for audit are as we go forward. That is why we wanted to bring in a proportionate approach for smaller bodies. We also want to undertake work to engage with the relevant parties, in particular local government, on the financial reporting framework. The financial accounts are complex, with all the statutory adjustments. We need to work on that at a UK level. We are putting energy into working with the new local audit office that is being set up down in England, and with CIPFA/LASAAC—the Chartered Institute of Public Finance and Accountancy and Local Authority (Scotland) Accounts Advisory Committee local authority code board—as the technical body, to try to improve the financial reporting framework, which will mean that less audit is required on top of that. That is the current arrangement, but we think that we can improve it in the future.
That is helpful. As you pointed out, it is better to spend money on front-line services, whether in health boards or in local authorities, so it is helpful to hear about the work that is being done to ensure that audits are more fit for purpose. Is there a timeframe for that?
As part of the work on our future of public audit model, we engaged extensively across Parliament and public bodies, and the view that came back was that we need to ensure that we have a strong quality regime, sticking to the international auditing standards, so that there is rigour in that regard. That came across very strongly from your predecessor Public Audit Committee.
That requires a lot of work with the local audit office down south, in particular when we focus on local government, and with CIPFA/LASAAC, as well as with the Scottish Government. We want to engage on that work, so I cannot put a timeline on it.
I caveat that by saying that some of the work on assets and the balance sheet has been discussed for a long time. We, in Audit Scotland, have had specific discussions on which we want to see much greater momentum. We will do everything that we can, but it is not within our gift. However, that does not mean that we will not pursue it.
That is helpful.
I will add one point. The model that we have in Scotland for annual audits has a wider scope. Auditors give an opinion on the financial statements, which absolutely underpins the approach, but the audits go further. The Accounts Commission and I ask auditors to give judgments on financial management and sustainability, value for money, use of resources, governance and leadership. We think that that model works—I believe that it does. I think that it gives assurance to people who use public services, and to Parliament and elected members in local authorities, on a much wider gamut. It provides an independent perspective on how an organisation is performing, and not looking only at the balance sheet, the notes to the accounts and the performance report, important as that is.
The feedback that we got from the consultation echoed that view of mine, and of the Accounts Commission, that that approach is felt to be one of the unique selling points. I do not have a crystal ball with regard to what the future might hold for the profession more widely, especially if it transpires that artificial intelligence is deployed in a commercial audit and commercial accounts preparation environment. The role of auditors is going to change, and it will be much more about organisational performance—how the money is being used and what outcomes are coming from that—as opposed to the numbers on the page.
Auditing has continually evolved. When I was doing it, tolerable error was the calculation that we had to use; now it is about reviewing information that AI has helped to collate, to ensure that it is checked by a human eye.
Indeed.
I will add a small point on that. In the time that I spend outwith Audit Scotland, I occasionally get into situations where audited bodies are present. The feedback that comes from them is uniformly positive about our non-financial commentary and how our observations have helped them in organising the way in which they do things, the priority that they give to things and so on. In a very nice way, the feedback is remarkably positive as to the impact that we are achieving for the audited bodies.
Again, that must go back to what Vicki Bibby said earlier about the importance of your staff and the team understanding the bodies that you audit and recognising where improvements can be made.
Absolutely. They need to do that, and they need to be able to relate to the people who they are informing. They must have the ability to communicate. I would add, given that I am of a certain age, that that should be beyond the communication of an AI screed, but that is by the by.
I have a final question on information technology, which is a theme that we have touched on quite a bit. It was noted in the report that information technology costs were higher in 2025-26 than in 2024-25 by £101,000, or 49 per cent, and I wondered about the reasons for that. We have touched on quite a few examples, from cyberattacks to the potential development of AI. Will you explain the increase, and then perhaps move on to the potential future costs on IT?
Thank you, chair. I will give Waqas Sanawar an opportunity to set out some of that detail for the commission.
The main reason for the increase in 2025-26, as the Auditor General and Vicki Bibby have highlighted, is due to one of the key risks on our risk register: cybersecurity. We invested quite heavily in 2025-26 in cybersecurity, which is why you see that jump. On the trajectory for future periods, we expect IT costs to increase, not only because of cybersecurity but because we have now started implementing our new audit software. The development costs relating to that will flow through in those line items.
That is helpful—thank you. It would be useful if the commission could be kept abreast of projected costs going forward.
I want to ask about the note in the report about incorporating AI into Audit Scotland’s future work. Have those discussions progressed since the report was published, and have any risks been identified in that?
We are progressing with caution in the use of AI. The technology is changing rapidly, and the amount of investment that some of the large audit organisations are investing in technology is eye watering. Audit Scotland has made quite considered and careful use of AI, with appropriate boundaries, particularly in reference to cybersecurity, and the information from public bodies that we use is ring fenced in our system. As the chair rightly mentioned, it is people—our colleagues—who make the judgments, not AI.
Waqas Sanawar was right to mention—Vicki Bibby covered this, too—that we are investing in IT equipment, audit skills and systems that our colleagues are using. The system that the National Audit Office has developed, which we are partnering with it on, is not an AI system, but there is scope for it to evolve so that it could use AI more carefully in the future.
The main assurance that I want to give the commission this morning is that we are treating AI with caution. We are putting the right governance scrutiny around it. We have set up a special project in Audit Scotland on how, when and at what pace we use AI in the organisation. Most fundamentally of all, our colleagues will continue to make the judgments, the decisions and the opinions that we give on public spending in Scotland. As I say, we treat it with caution. The chair is keen to be updated on our IT, and I suspect that AI and our use of it will be a regular feature of the engagement that we have with the SCPA. Colin Crosby might want to say a word or two on that.
A year or so back, the board was perplexed by AI, and we convened what we described as a “deep dive” into the risks that are associated with it. An intriguing point was made in comparing advanced automation and AI. AA is about making proper use of all the digital facilities that there are, such as data analysis and data retrieval, which enable people to deal with their work much more quickly. That is not AI; a significant part of that gets swept under the banner of AI, but, in fact, it is advanced automation.
At the moment, the AI part is a relatively small proportion of what we are proposing, and it is what we are looking at very carefully as a board, for all the judgmental reasons that we have just discussed. There is no doubt that it is here or that it will enable us to do more detailed work more quickly with, I suspect, the same number of people as opposed to fewer people. On the cost front, its use will increase our costs on IT, licences and software. That will become an integral part of the budget, which will change; there might be slightly fewer people, but there will be an increased IT cost.
As members have no further questions to ask, I thank you for the evidence that you have given us this morning. We will have a short suspension for a changeover of witnesses.
11:41
Meeting suspended.
11:43
On resuming—
I welcome to the meeting David Jeffcoat, who is a partner, and Jillian So, who is an audit and accounts manager, at the TC Group. Would you like to make any comments before we move to questions?
Yes, I will—thank you. Good morning, chair and commission members. I will give a summary of our work to accompany our audit opinion and our audit summary report.
We were appointed to carry out the external audit of the financial statements of Audit Scotland for the year to 31 March 2026. Our audit work commenced with planning and interim work in February, our main audit fieldwork started in early May and I signed the audit report on 12 June.
Our audit was carried out in accordance with international standards on auditing. Our audit opinion is contained in the audit report in the accounts, and it confirms that the financial statements of Audit Scotland give a true and fair view as at 31 March 2026, and that they have been properly prepared in accordance with international financial reporting standards, the Government’s financial reporting manual and the Public Finance and Accountability (Scotland) Act 2000. Our opinion also covers sections of the remuneration report and confirms that those were properly prepared.
For the record, I can confirm that adequate accounting records have been kept by Audit Scotland, and that we received all the information and explanations that we required before issuing the audit opinion. Our audit opinion confirms that expenditure has been incurred and receipts have been applied in accordance with the 2000 act.
As part of our audit work, we have prepared an audit summary report on the management of Audit Scotland, a copy of which has been sent to the commission. The audit summary report notes our responses to key audit areas and, where applicable, reports on any weaknesses in the accounting systems and internal controls that have come to our attention during the audit.
11:45
I will summarise our response to the key areas. Our audit work on management override of controls considered the authorisation, appropriateness and accuracy of bookkeeping, accounting journals and related financial controls, and we identified no issues to bring to the attention of the commission. Our audit work on revenue recognition considered the accuracy of recording income in the appropriate accounting period and is linked to our auditing of work-in-progress balances. We are satisfied that the accounting estimate for work in progress adopts a consistent approach with prior years; it is based on sound assumptions and is accurately calculated. We believe that there is no material misstatement of revenue or work-in-progress balances.
Our audit work also considered the appropriateness of pension accounting. Our review of the accounting treatment of pensions on the statement of financial position and the notes to the accounts identified no issues. We are satisfied that the treatment of the pension balance being nil on the statement of financial position is consistent with recent previous years and with the actuary’s reports, and all the disclosures have been noted appropriately in the financial statements.
Our audit summary report notes actual or potential accounting adjustments that were identified during the audit. Although adjustments of a presentational nature to some narrative in the disclosures in the annual report were identified and updated, our audit work did not identify any accounting adjustments to the draft accounts themselves. We identified two minor potential adjustments, but neither had a material impact on the statement of net comprehensive expenditure, so we were content for those to remain unadjusted.
Our audit summary report is an opportunity to propose recommendations on the internal controls or financial controls that are in operation. I am happy to confirm that we did not identify any matters that we needed to raise with management or the commission.
I record my own and my audit team’s thanks to and appreciation of the staff at Audit Scotland for their continued helpful and prompt co-operation during the audit. I am happy to take any questions from the commission.
Thank you. That was very thorough, and you covered a lot of the questions that I had noted down, which is good. You mentioned two minor adjustments. Will you outline what they were in relation to?
Yes. Those are on page 7 of our audit summary report. One is to do with class 1A national insurance contributions. You have to remember that the accounts are prepared at the end of April, so this is quite an early audit. We started our main fieldwork at the start of May, so there was an element of estimation in there, and then, as we progressed, we identified that there was a miscalculation of £28,000, which is just over what we would consider trivial but is certainly not material.
The second potential adjustment, which is on that page, is on lease liability prepayments. It goes back to the accounting standard that was brought in about three years ago in relation to lease liabilities and right-of-use assets. What had happened was that some rent had been paid early and had been allocated to prepayments, when it probably should have been under lease liabilities. However, in the context of the overall financial statements, the number—just £67,000—is not considered to be material, and we are happy for it to remain unadjusted. That means that there is slightly less work, but, if you start changing small balances, that has a knock-on impact on other work. We are content overall with both of those.
That is helpful. As members have no further questions to ask, is there anything that you would like to add, Jillian?
No, there is nothing that I would want to add.
I thank you very much for attending today and for your evidence. We will have a short suspension for another changeover of witnesses.
11:48
Meeting suspended.
11:51
On resuming—