Chamber and committees

Good morning, Auditor General. The committee has seen a lot of reports, but this is probably one of the most damning. Your comments in the report that

“The Scottish Government has not provided the necessary leadership for progress”

and

“Current arrangements are unlikely to achieve the ambitions for skills alignment at the pace required”

raise a lot of concern. The report states that the

“intended benefits of skills alignment ... have not been realised and the opportunity for more efficient and effective investment has been missed.”

I appreciate that this might be hard to quantify, but do you have any information on what the largely failed project has cost the public purse or, indeed, on what the opportunity costs have been as a result of the catalogue of errors outlined in the report?

I think that you are right—the issue is the lost opportunity to bring benefits.

The report highlights that, although the Scottish Government made a commitment to skills alignment, there was a complete absence of strategic intent or a performance management framework to measure progress. Why were those fundamental elements not put in place? To what extent has that led to the significant lack of progress in skills alignment that is highlighted in your report?

Thank you. I was going to ask about progress, but you have already answered my question.

That brings me to my final question. The audit report takes us up to the end of November 2021. It is obvious that more Government involvement is needed. The Auditor General said that the Government welcomed the report and that it intends to issue further letters of guidance. Are we aware of any actions that the Government has actually taken since the report was completed?

You have covered some of the issues that I wanted to touch on in my next questions. In 2021, the now disbanded skills alignment assurance group was tasked with agreeing a definition of “skills alignment”. That was just three years after the Scottish Government, SDS and the SFC agreed a road map for skills alignment. Is the lack of a shared definition of skills alignment indicative of a lack of a wider shared vision across the Scottish Government, SDS and the SFC? More important, how confident are you that a shared vision can ever be achieved?

The Auditor General touched on my first questions in his opening statement. Paragraphs 8 and 9 of the report state:

“SEPA commissioned independent reviews of the cyber-attack so that it, and the wider public sector, could learn lessons.”

The reviews concluded

“that SEPA had a high level of cyber security maturity, but further improvements could be made”.

They also

“made 44 recommendations for SEPA”

to take forward

“to enhance processes and controls in relation to information security.”

Given that SEPA was found to have a high level of security maturity, 44 recommendations seems to be a lot. How likely is it that other public sector organisations that are also considered to have a high level of security maturity are at risk from a similar cyberattack? Have all the recommendations been passed over, and is SEPA taking action on them?

Good morning. On compliance of Scottish income tax payers, one issue that has arisen during the scrutiny of previous NAO income tax reports is whether any evidence of behavioural effects has emerged as a result of Scottish income tax rates and bands diverging from those in the rest of the UK. In 2020-21, Scottish taxpayers paid more income tax than taxpayers south of the border on earnings of over £27,000, with a difference in excess of £1,500 on those earning over £50,000 per annum. The NAO report states:

“HMRC continues to assess as ‘low’ the risk of non-compliance as a result of divergence between Scottish income tax and the rest of the UK”

and

“HMRC has not identified any significant or widespread instances of taxpayers changing their address to obtain a tax advantage.”

What is the definition of “significant” or “widespread” in this instance?

So it is not causing concern just now, but you are keeping an eye on it.

My other question concerns HMRC. It has limited performance data available about its compliance activities in Scotland. Unlike its income tax system, which flags residents as Scottish, HMRC’s compliance system cannot readily identify people living in Scotland. Therefore, it cannot easily track and monitor compliance activity in Scotland, which affects its ability to collect performance data about the extent of Scottish non-compliance.

Why is there limited performance data and compliance activity in Scotland, and what, if anything, is being done to address that?

We note that the commissioner was appointed as commissioner and accountable officer on 1 April 2019. Paragraph 8 on page 3 of the section 22 report outlines that

“The Commissioner has been on extended leave since early March 2021.”

We also note that the Scottish Parliamentary Corporate Body appointed the public appointments manager as acting commissioner and the head of corporate services as acting accountable officer on 20 April 2021. Do you know the reasons why the acting commissioner is not also fulfilling the role of accountable officer?

That is fine. Thank you.