Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, December 8, 2016

Official Report 515KB pdf

---

Section 23 Report

---

“Common Agricultural Policy Futures programme: An update”

Item 2 is an evidence session on the Auditor General for Scotland’s report entitled “Common Agricultural Policy Futures programme: An update”. We want to explore in more detail some of the issues arising from the Auditor General’s report and also to understand what broader lessons the Scottish Government has learned from the programme. I welcome from the Scottish Government Leslie Evans, permanent secretary; Liz Ditchburn, director general, economy; Elinor Mitchell, director, agriculture, food and rural communities; Nicola Richards, director of people; and Anne Moises, chief information officer.

I thank you for being able to attend this morning after we rescheduled the meeting from the original date. I invite Leslie Evans to make a brief opening statement before I open up to questions from members.

Thank you, convener. This morning, I want to look briefly to the past and then ahead to the future of the CAP futures programme. First, I want to reiterate the apology that was given by Liz Ditchburn to those farmers and crofters who have had to cope with delays and significant uncertainty around their 2015 payments. As a Government, we have not delivered the level of service that people expected. The Cabinet Secretary for Rural Economy and Connectivity has already apologised and I echo his apology this morning.

Secondly, in my letter to the committee of 3 November, I apologised for the fact that, in their committee appearance on 29 September, officials did not proactively raise the issue of the miscalculation of the loan offer for a proportion of potential loan applications. Their view at the time was that that was an operational matter for which corrective actions were already in place, but it would have been helpful for the committee to have been informed of the issue and the action that was being taken. I am sorry that that did not happen.

Looking to the future, we have greater confidence about CAP 2016 payments than about CAP 2015. There are three reasons for that. First, the underlying system is better. We are continuing to address coding issues, have been stress testing the system and are confident that it is more stable. We are planning and co-ordinating the work better, including the phasing in of different functionality information technology drops.

Secondly, we have improved governance and decision making, and our workforce and teams are more positive and engaged.

Thirdly, we have established a culture of greater certainty in our commitments and of learning from past mistakes. For example, advice and support from internal audit now provides a greater degree of assurance on some manual processes. However, we cannot be confident of total success, not least because we remain reliant on more functionality drops to deliver the CAP-compliant system that we need, so I cannot commit to there being no further errors such as those on which we recently wrote to the committee. Indeed, my colleagues will want to apprise you of an incident yesterday regarding some data handling.

The CAP futures programme covers more than 18,000 businesses, many of which receive two or more transactions within a complex and complicated regulatory regime. There can be no guarantee of perfection.

In summary, we have a qualified sense of improvement but absolutely no reason for complacency. We remain vigilant on the quality and responsiveness of services for our customers—the farmers, the crofters and all who are involved.

Thank you, Ms Evans. The first question is from Liam Kerr.

Good morning. I want bring us right up to where we are today and talk about the loans that have been made under the national basic payment support scheme. Ms Evans, your letter to the committee of 7 December says that 166 businesses have been overpaid a total of £746,000. There is a bit of an explanation in the letter, but will you explain how that has happened?

I will ask Liz Ditchburn and Elinor Mitchell to give a bit more detail about the background to that.

As you know, the loans are paid through a separate system from the main CAP futures system—it is a separate system that we built for the 2015 loan process and are using again for 2016. The first batch of payments to farmers—12,500 payments totalling around £256 million—went out completely successfully on 4 November.

We continued to process applications that came in later than that. The second batch of payments—602 cases—went out on 23 November. As you said, 166 of them contained an error, in that the formula for the calculation of the exchange rate from euros to sterling was changed erroneously, which meant that the wrong numbers were calculated. The error involved an unprotected cell in the spreadsheet, which should not have been there. We have picked up that issue and have corrected it by ensuring that spreadsheets have appropriate levels of protection. However, we can confirm that the previous batch of payments—the 12,500 cases—was not affected by any such error.

Okay. The letter says:

“This appears to have been caused by human error”.

You are confirming that, are you?

Indeed.

The letter also says that the formula was “accidentally changed by someone”. Have we identified who?

I do not know. Elinor Mitchell might want to say more about the investigation that she undertook.

We have identified the individual involved.

The letter says that the person was part of

“a team outside of the loans team”.

Is that team part of your directorate, with the person therefore being employed by the Scottish Government?

Yes.

Obviously, you—or we, rather—are looking to get repaid. Mr Ewing’s letter to the Rural Economy and Connectivity Committee says that you have started to issue invoices,

“with a repayment term of 30 days”

and that the

“policy is not to charge interest on the overpayment.”

What happens if people have not repaid at 30 days?

As of 5 December, we have spoken to 159 of the individuals involved and we are still progressing the ones that we have not been able to get in contact with. All but two people we have spoken to have been very willing to repay the money and have said that they will do so in the appropriate time period. We will continue to follow up with the two who have not yet confirmed that they will make the repayment. However, all of those individuals will be due some further money, so we would reclaim the money from future amounts that are paid to them.

There are 10 or 11 people who you have not been able to contact yet—

There are seven cases.

Seven cases. Let us say that you are unable to contact them in any way, which means that they will not repay within the 30 days. What happens to their payments after 30 days? Do they pay interest on those?

No. The 30 days will not start until they are contacted. We will continue to try to contact them. Clearly, those are all our customers, so—

Sure. But will they pay interest if they do not pay back within 30 days?

No. We have not contacted them. If you are talking specifically about the seven that we have not contacted, we will continue to try to contact them. The 30-day period will not come into effect until we have contacted them and issued them with a letter.

And if you contact them and they do not repay in the 30 days, will you charge interest on those overpayments?

We would need to take some further advice on that. The 159 we have spoken to have all confirmed that they will repay within the 30-day period, and we would expect them to do so.

But you are unable to answer my question.

I think that the point that Elinor Mitchell made earlier is that all of those people, without exception, are due additional money. In other words, unless I am incorrect on the figures, there is another payment to go to those individuals, including the seven. The money will be recouped by the Scottish Government through a reduction in the money that is due to those seven if they have not paid during that time.

In any debt recovery process, we would always look to have a discussion with the individual and understand what their position is. Legally, the terms and conditions are clear that we have the ability to charge interest. Any decision about whether to do so would be taken on an individual, case-by-case basis. As I think is the case with anybody seeking to recover a debt, it is related to our understanding of how a particular customer is approaching the issue.

Right. A lot of payments are being made, and there are a lot of different sums. If I were a farmer, that would be complex for me. I am finding things complex sitting here, and I have not seen all the correspondence. How detailed is the information that you give to people so that they know what is going on?

About loans or the normal payments under the CAP basic payment scheme?

About all of it. As you have quite rightly pointed out, there is a large number of payments. I find the system rather complex.

As members know, there have been delays in sending the letters about the BPS payments. I think that we discussed that with the committee in the previous hearing. In a normal year, we send letters out as soon as possible. There are three letters: one tells people what their entitlement is; one tells them that a payment has been made on that basis; and another refers specifically to any reductions or exclusions in a particular case. As we said to the committee last time round, those letters were not able to be issued prior to 15 October, because we were prioritising making the payments, but we are now working our way through them.

Let me ensure that I have the details. The entitlement letters were issued on 18 November, so farmers received that information after the last time that we were in front of the committee. The payment letters, which tell people how much money they are being paid under the schemes, began to be issued on 28 November. I think that 14,000 have been issued to date. That is the latest number that we have. Around 2,500 a day are being issued, so that process will be completed reasonably soon for the full population. The reductions and exclusions letters will not go out until next year.

Farmers are getting information, and they will have more information. Obviously, we understand that it is frustrating and concerning for them that they have not had the full information as quickly as we would have wanted them to have it, but it is important to note that the 60-day period for the appeal process that they can rightly go through if they believe that they have been paid an incorrect amount will not begin until they have received the appropriate letter. Therefore, nobody will be unable to appeal or will be disadvantaged in putting forward an appeal because of our delay in issuing those letters.

We are working our way through the issuing of those letters as quickly as we can.

I have a final question on the loan issue. The loan scheme was addressed on page 5 of the Auditor General’s report, which is a summary page, back in May. She specifically said:

“This introduces risk to the Scottish Government budget, including risk of duplicate or over-payments, and delays to other spending if the loans are not repaid when expected.”

We understand that lessons have been learned. That report, which was published back in May, seems to have flagged up that there could be an issue with the loan scheme and that the robustness of the system is a cause for concern. We are now in December, and the exact issue that the Auditor General seems to have flagged up has come to pass. So have lessons been learned? Can we have confidence going forward?

Elinor Mitchell might want to speak about that in more detail.

It is clearly regrettable that those mistakes or errors have been made. As the permanent secretary said, we are deeply sorry for the inconvenience to any farmers or crofters who have suffered as a result. However, the vast majority of payments have been made accurately. Some 12,500 farmers and crofters have received a nationally funded loan that is based on 80 per cent of their 2016 basic payment, and the teams are processing the vast majority of payments without error.

It is regrettable that the issue with the reversal of the exchange rate happened, but we now have internal audit in. It has checked our spreadsheets and continues to work with us to ensure that our manual processing of those payments in the systems is as accurate and good as it can be.

I will start with the issue of interest payments. The seven people—or it might be nine—will have to repay some money, but the issue of whether they are to be charged interest is not resolved. Going right back to the start of this fiasco, for those farmers who were very late in being paid the money that they were entitled to by the Scottish Government, did you add interest to their payments?

09:15  

No.

So why are you even considering adding interest when this further mistake has been made? Surely that would be absolutely the wrong thing to do, morally, even though people might take some time to pay.

Liz Ditchburn gave clarity on that. She differentiated between having the authority to charge interest and a decision about whether that is appropriate for the seven loans that remain unpaid. Whether that is appropriate would need to be very carefully thought through. You know the circumstances and the history around the project. We are cognisant that people have had to be patient and have had to respond to the circumstances and the operation of the delivery. Liz Ditchburn was trying to differentiate between the authority that we have to charge interest and the issue of whether that will be exercised in certain circumstances.

To be clear, there are not seven people who have refused to pay. We have not contacted them yet, and we will continue to try to contact them.

I am just using that as a hypothesis. You have indicated that two people have not yet confirmed that they are going to pay, and you say that you will just take that off their money.

No—I did not say that. Two people have not confirmed, and we are continuing discussions with them. There are seven whom we have not yet been able to contact, and area office staff are continuing to attempt to do that.

That is what I am saying. I would have thought that, given that you did not pay them interest when the payments were so late and so badly handled, it would be rather odd if you charged them interest for a situation that arose because of incompetence in the Scottish Government.

Our position is that we have asked them to repay within 30 days and at the moment we have said that no interest will apply because there has been an administrative error. As I said, we would of course take advice if people refused to pay. We have the option of repayment through a reduction in future payments that we make to them. As Liz Ditchburn said, there would be an option to charge interest after that date, but no decision has been taken on that.

If you charge interest, that would be one law for them and one law for you. Using the same logic, you should have paid interest as a result of the substantially delayed payments.

The CAP payments are of course made on a very different basis. They are regulated by the European Union processes, under which our legal obligation, as set by the regulations, is to pay farmers before the June deadline. Of course we would have wanted to pay farmers well in advance of that, but that is how the European regulations are set up.

It is important to recognise that the loans were offered on an opt-in basis. We offered farmers the option of a loan with full transparency on the terms and conditions, and they could choose whether to take that up. Of course, we absolutely regret the error and the miscalculation of some of those loans and we take responsibility for that, but we are going through normal debt recovery processes. On a financial stewardship basis, it would be remiss of the Government to issue loan offers without having the kind of protections and interest arrangements in place that anybody would expect when someone is making loans.

In taking the decision whether to apply interest, you have to take into account that the loans were instituted in the first place because of the huge mistakes and incompetence of the Scottish Government. There is also the subsequent incompetence in mishandling and miscalculating 166 loans that were issued.

If we find ourselves in a situation where a farmer or a customer decides that they are not willing to repay, the full context will of course be taken into account as we make the decision on that.

We have the mistake with the 166 loans and then there is another one that you mentioned that happened yesterday. The letter from Fergus Ewing to the convener dated 7 December says that the reason for the issue with the loans was that

“The formula for turning Euros in to Sterling was changed for these cases (instead of multiplying by 0.85, the figure was divided). This appears to have been caused by human error—that the formula was accidentally changed by someone during the data inputting process”.

Is there no quality control? In the private sector, that would have been picked up by a quality control team. Do you have no quality control whatsoever?

We have quality control—

It is not working, though, is it?

No—it has not worked in that instance. My assessment is that the issue is indicative of the fact that a number of teams and people have been working under sustained pressure for a long time. It is regrettable that errors are continuing to happen but, as I say, that is indicative of some deep-seated issues around tired and stressed staff.

You are the management. What are you doing about it? You come here every time apologising and saying that you are sorry and that you hope that it does not happen again. The permanent secretary made it clear in her introductory remarks that we perhaps should expect even more mistakes to be made. You do not have confidence that the process is going to be handled properly from here on in. We are now 15 months into this fiasco and you still do not have proper procedures in place. You have tired and overworked staff. You are the management, so what are you doing about it?

We would very much like to talk to you about that. Elinor Mitchell will explain that in more detail. It would be interesting for the committee to have her perspective on what she has seen and the actions that she has had taken over the past 11 weeks or so since she has been in post.

The permanent secretary mentioned an issue that arose yesterday, and I would like to inform the committee of it now so that you have the full information on it. As you know, we are already in discussion with the committee about a number of errors, which have been communicated to you in writing. I need to inform you of an administrative error in an email that was sent to beef efficiency scheme applicants yesterday, which meant that some email addresses of other applicants were visible. That is a data protection and data handling issue. We take the privacy of our customers extremely seriously and we apologised the same day—yesterday—for that error. We are in the process of reporting the potential breach to the Information Commissioner’s Office, if we have not already done so—Anne Moises may have the latest on that.

As Elinor Mitchell says, that underlines the depth of the challenges that we face and the impact on teams of working under sustained pressure for a long period. Indeed, it underlines the full impact of the complexity and the number of schemes that the Scottish Government is running for common agricultural policy payments. In addition to the schemes that we have designed, as a result of the challenges and problems that we faced we have added further schemes such as the loan scheme. That level of complexity and challenge is not something that we will get out of quickly—we want to be honest with the committee about that.

I talked about the issue when I gave evidence to the committee previously. The way that I described it was:

“It is a long, slow grind, which involves putting in place the appropriate protocols and processes.”—[Official Report, Public Audit Committee, 29 September 2016; c 47.]

That is indeed the case. We need to be honest with you that there is no quick fix to building strong and robust systems. Significant progress is being made on a strong and robust IT system, but the people systems, the way in which we manage people and the protocols and quality assurance—all the things that we need to have in place and that need to be consistent across the piece—are not currently where we want them to be. That is, in part, the impact and the result of the kind of working that has been necessary to get payments to farmers over the past 18 months. We are still living with that legacy.

Perhaps Elinor Mitchell would like to say something about her perspective and how she is seeking to turn things around over the time periods that we are talking about.

As Liz Ditchburn said, I have been in post for just over 11 weeks. Clearly, a lot of work has been going on in those 11 weeks around finalising the 2015 payments, ensuring that the teams have prioritised the work on loans and delivering assurance for the 2016 CAP round, which has just started.

The issues that I have uncovered are largely the issues that have been raised in reports by Audit Scotland and others. I have spent significant time on reviewing protocols and desk instructions. I have asked internal audit to review things such as our use and management of spreadsheets and our control and checking protocols, which we have now changed as a result of that. I have taken steps to fill some key vacancies that have been left vacant for some time, including vacancies for 24 agricultural office staff, some 20 field inspector staff, business support staff and staff in the finance teams. I have also reviewed our approach to risk management. We are now part of a wider Scottish Government pilot programme on risk management, and we are taking steps to improve our performance management arrangements across the team, including through supervision of staff who are undertaking key roles.

The obvious question to the permanent secretary is, why has that happened only in the past 11 weeks, since Elinor Mitchell came into post? Why has it not happened long before now?

There are several reasons for that. First, we need to go back to the origins of the project, as the Auditor General herself has recognised. We are still feeling the ripples and resonances of a project that was set up in incredibly complex circumstances in which our response to late and continuously changing regulations from the EU up to the very last minute—even when we were due to produce and operate the system—was complex. We chose to take a more complex route in how we applied policy. A range of circumstances prevented us from producing an IT specification at the right time and in the right circumstances, which would have allowed us to be more front footed in what we were doing. All the way back to the beginning of the project, we are still uncovering difficulties whose roots are in that space.

Secondly, I could not have asked the team or the teams that preceded Liz Ditchburn and Elinor Mitchell to work any harder—I wish to stress that. They are learning more and more as we continue to try to move from an emergency response rate and a reaction rate to a greater level of certainty, so that we can start to plan further ahead. We are taking steps on that. When Liz Ditchburn took up her post at the beginning of May, Elinor Mitchell’s appointment was one of the firm commitments that I asked her to make in relation to the changes that we needed to make to get the next session’s payment responsibilities and commitments in better order than they were in in 2015.

A range of other activities and actions have been taken, including at my hand and at Liz Ditchburn’s hand. The ones that I would focus on are those in relation to which we have learned from what has gone on with CAP. We are applying that learning to gain a wider understanding of what we need to be better at and of where we need more robust systems in the Scottish Government as a whole. As the principal accountable officer, I take my responsibilities in relation to that very seriously. We can talk a bit more about those responsibilities in due course.

We have a project and a programme that had the most difficult birth ever, which is still resonating in some of the circumstances. We have a team that busted a gut—to use a colloquialism—to keep the system, on my instructions, focusing on compliance and on customers. We had to make some suboptimal decisions around that time, and I take responsibility for that. My challenge at that time, in supporting the accountable officer, was to focus on customers and compliance. That is what he and his team were focusing on, and it is the focus that Liz Ditchburn and Elinor Mitchell have continued to prioritise in the period since then.

I do not think that any of us would want to blame the team who are working flat out to help. The issue is the management of the whole thing from day 1. We are still seeing mistakes. At this stage in the game, the team is tired so you should bring in additional people to untire the team. The more tired people are, the more mistakes there will be.

The issue seems to be about basic rules of management. If you were a private company, you would have gone out of business. The mistakes are happening almost daily, yet it is 18 months since the project started. That is an unacceptably poor performance. We cannot be sitting here in six months’ time with you saying, “We apologise. We have had another two mistakes this week. We had another two the week before, and we have had to create a new loan scheme.”

We are talking about public money and people’s livelihoods. We need something far better. This performance is not acceptable.

I agree that it is not good enough. It gives me no pleasure to come before the committee to explain the difficulties that we have faced and, indeed, the mistakes and errors that have been made. I would be misleading you, however, if I did not recognise the complexity and difficulty that we are working through even now, which you have heard about from some of my colleagues.

You talk about management and responsibility—

I am sorry to interrupt, Leslie, but there is nothing complex here. We all make human errors—of course we do. I would in no way castigate somebody for making the human error over the exchange rate. We all make errors. The problem is that, given the IT system’s recent history, there should be a quality control process in place to pick up errors before the payments are made to customers.

Indeed.

09:30  

The same goes for the mistake that was made yesterday. It seems that there is no quality control process for picking up those errors.

Elinor Mitchell has talked about what we are putting in place at the moment, and she can tell you more about that.

Previously, the focus was on ensuring that the IT system could produce what was required to enable us to get vast numbers of payments to 18,000 businesses in the rural economy as we needed to and in a timely fashion. We have greater confidence in the IT system as a result of all that work and as a result of an IT assurance system that I commissioned for the whole of the Scottish Government. Annie Moises can tell you more about that.

However, the issue is not all about IT; it is also about operational skills, operational management and good and effective use of our resources. On her appointment in May, Liz Ditchburn highlighted the importance of investing in our staff and continuing to move people around in a flexible and fluid way. That had been highlighted previously, following reviews that I instigated as well as the gateway reviews and the Audit Scotland reports. It was hard to make that investment—indeed, it was impossible—while we were still fixing things in flight, as it were. In order to ensure that the IT system could deliver what we had committed it to delivering, we had to be able to carry on fixing it while we were in flight.

Following the publication of the Scottish Government people survey results, which came out a couple of weeks ago, I am delighted to be able to say that we have a more engaged and happier staff than we have had in previous years. That is a result of the efforts that have been made to improve management, support and resource allocation. It also reflects the redesignation of roles that took place in the first half of this year to increase the scale of the programme’s operation and to ensure that, whenever possible, we are able to give people assurance and confidence with regard to the responsibilities for delivery.

As the PAO, I would be misleading you and giving you poor advice if I were to say that there will be no more errors in a situation that is so complex, that has the history that this does and that is still responding to absolutely immutable deadlines, which we have always tried to adhere to. Furthermore, the situation is overlaid by a complexity that is the result of decisions that were made at the very beginning, during the setting up of the programme, in response to stakeholder requests, which makes it unique in the UK.

There is nothing complex about getting somebody to double-check the exchange rate in a manual system. That would be par for the course in any system.

I appreciate the complexity, the IT problems and the fact that everyone is working flat out to rectify the situation, but it will never be rectified if the necessary management systems are not in place. The basic management system is a quality control process that ensures that such mistakes are not made.

I agree.

How much additional money—money that was not budgeted for—has this fiasco now cost the Scottish taxpayer?

I can tell you only the amount of money that has been spent on overtime, because that figure is over and above the envelope that CAP futures has been allocated since May 2015. In May 2015, we revisited the business plan and said that CAP futures would cost £178 million. That is the envelope that we are still working to. In addition, there has been some overtime. I think that, earlier this year, we wrote a letter to the committee about the number of staff that we deployed in 2015 and 2016.

What is the cumulative overspend to date?

The overtime costs for the rural payments and inspections division area office staff in 2015-16 came to £348,000. A good chunk of that would normally have been expected to be incurred, because it is part of how the system operates. We have tried to do some analysis in order to break that sum down a little more. At the moment, my understanding is that the sum is about £150,000 more than it would have been in normal circumstances.

Elinor Mitchell has been brought in during the past 11 weeks. Did she replace someone?

Yes, she replaced somebody.

Have any additional posts been created to deal with the crisis?

Liz Ditchburn will keep me right on this. The additional post is that of the chief operating officer, who is the person who operates the control room, which is the crucial element between the centre and the area offices and delivery. It is a really important part of the system.

Is the cost of that post included in the additional cost figure?

I will have to check that for you.

No, it is not in the overtime figure, because it is a core post.

Can we get an up-to-date, full breakdown of all the cost figures, please? I do not mean just now—could we get it by letter?

The challenge is that the costs are difficult to determine. Take the overtime figure, for example. Elinor Mitchell referred to a number of posts having remained vacant. It is hard to track within those budgets the situation as it would have been, the situation as it turned out and the difference between the two. Agriculture policy and the directorate that Elinor Mitchell’s job oversees contain a number of other functions, and we move people around as flexibly as we can to ensure that, if there is a gap on the payments side, for example, we are able to bring someone across. We do not always track that as a budget movement, because we pragmatically move people from one team to another. Therefore, it will be difficult to give the precision that you seek in the figure because many of the changes are simply about moving people around.

Surely, in your agreement with the EU, there is a budget line for administering the scheme.

It does not need to be agreed with the EU. It is our decision.

However, there is a budget line for the cost of administering the scheme.

There is a budget line in our internal budgets for the rural payments—what does the I stand for?

Inspections.

There is a budget line in our internal budgets for the rural payments and inspections division, which not only oversees and manages the scheme but undertakes a range of functions—for instance, it develops new schemes. However, we know exactly how much that is.

To calculate that budget line, you must have estimated the cost of the scheme.

Yes.

It is a simple question. Whatever the difference is between your original estimate of the cost of the scheme and the actual cost is the additional cost. That is the figure that I am asking for. It should not take an Einstein to work it out.

We can give you the original budgets as they were set and the outturns for the RPID.

Okay. Thank you.

I call Mike Rumbles.

I am here as reporter for the Rural Economy and Connectivity Committee. I thank the convener for calling my question.

I am not sure whether the committee is aware but, yesterday—the same day that the committee received the letter from Leslie Evans—the Rural Economy and Connectivity Committee received a letter from the—

We are aware.

Good. The farmers who are listening to the meeting realise that they would normally be getting their entitlements by now. We are told that, under the loan scheme that has been offered, 12,500 farmers and crofters have received a loan based on 80 per cent of their entitlement and 17,800 loan offers have been issued. That means that one third of farming and crofting businesses have not taken up the offer of a loan. One has to ask why that is.

Could it be that farmers are not aware of the amounts of money to which they are entitled? It has already been commented that the letters about that have not gone out. If money appears in any business’s bank account—or even in our personal bank accounts—the business does not know whether it is the correct amount of money unless someone has told it. Some farmers have told me personally that they do not know what the money is for, whether they are entitled to it and whether it is really 80 per cent of their entitlement. Therefore, they are not taking it. Leslie Evans says that there are only 166 errors, but farmers are aware of continuing errors and do not have confidence in the loan scheme.

Does the Government realise the problems that farm businesses have and understand their reluctance to take what is on offer? Their lack of confidence in the process is undermining their businesses. I would like a response to that.

It seems to me that errors are continually being made. In the letter that the minister wrote to Edward Mountain, he talks about 166 businesses that have been affected to date. In your letter to Jenny Marra, you state that

“A payment to one business of £0.85m was made twice”

and that

“22 businesses have received duplicate payments totalling just over £0.5m”.

However, that information has not been given to the Rural Economy and Connectivity Committee.

There is confusion out there in Scottish farming. I would like your reaction to that. Do you not appreciate that all these difficulties are really adding to what appears to us to be a crisis in rural Scotland?

I do understand and I do recognise the picture that you are painting. I understand, which is one of the reasons for my apology, the impact of the situation not just on farmers and crofters but on the businesses that sell to them. Indeed, I have had—I think—nine meetings with area offices. I have been to Portree in Skye, where I know some of the community, to Orkney, to Oban, to Inverness, and to Pentland house and Saughton house, and I have been talking to people who are in daily contact with the people you are talking about. They are very clear about what they are hearing, and the feedback that they gave me was very compelling, so I do not underestimate the impact of this at all.

I will ask Liz Ditchburn to talk in a little more detail about the process that is in place, but we are contacting everybody who is entitled to take up a loan to assure them and give them the opportunity to take it up.

Why do you think they are not taking up the loans?

I can understand why they might decide not to take up a loan. I will hand over to Liz Ditchburn, who can give some more detail on that.

As PAO, I took a decision to ensure that this committee and other committees should be informed when we make errors. I did that for two reasons. The first is that I feel that we have to be up front, clear and frank about the circumstances and the improving competence as well as the risks that still occur for the reasons that we are talking about this morning. Secondly, we know that people in the community know that an error has been made, so Parliament needs to know about that as well.

I want to be up front and open about this, but I am not just apologising to farmers and crofters; I also recognise the difficulties that the situation creates for our area staff and their relationships with people and we are working hard to try to resolve it.

This morning, we are talking about some of the specific actions that are under way in the specifics of RPID—in Liz Ditchburn’s and Elinor Mitchell’s area—and more widely with the learning that is being applied across the Scottish Government. I can talk a little more about that in a moment, but first Liz might want to talk about the loans.

Elinor Mitchell should come in as well. As has been said, so far, about 5,000 people have chosen not to take up a loan. That is a lot of people for us to contact them all directly, but they have all had an offer and they can all contact and talk to their area offices.

I think that the team has phoned a sample of about 200 of them to talk it through, try to understand in detail the customer reaction, and to ask why they have chosen not to take up the loan and whether they wish to reconsider. There are different categories within that. Some people have absolute confidence in their cash flow and do not need to take the loan. They are saying clearly, “No—thank you very much for the offer, but we really don’t need it.” Equally, some are more unsure, do not want to take credit at all and have concerns about being in debt. There is a range of issues there, some of which might be reflected in some of the feedback that the committees have had.

It is also important to say that we have had a lot of positive feedback from farmers who have chosen to take up the loan and have found the certainty extremely beneficial because it has given them confidence about their cash flow and allowed them to plan effectively. We have had some very positive responses. However, we want to make sure that no one decides not to take up the offer for the wrong reasons, in a sense, such as because of a lack of confidence.

As I said before, it will take time to build the trust and confidence of the industry back up, and there is no short cut to that. We have to deliver a better 2016.

We wanted to start 2016 by making the offer of the loan, so that people would have some level of certainty, but we have to deliver a better level of payment performance through 2016. We hope to rebuild the industry’s confidence gradually, but I do not underestimate the time that it will take and the impact that it will have in the meantime.

Elinor, will you say more about the feedback that we are getting from farmers?

09:45  

Yes, I am happy to do that. First, I will give an update. We did another payment run on loans yesterday so we have now paid out 12,824 loans totalling just over £261 million.

As Liz Ditchburn said, we have contacted a small sample of the potential applicants who have not come back to us. Through the area office network, we have asked staff to raise the issue of loans in their day-to-day conversations with farmers, and to make sure that everyone is aware that getting a loan is a possibility.

Various categories of people are saying that they do not want to take up the offer. Some do not need the money; some do not like the word “loan”. We have been asked to call it an “advance payment” rather than a “loan”, but there are issues with that, so we decided to go with “loan”.

We are not complacent. We continue to raise the issue. When our agricultural staff are out on farms—as they are every day—they raise the issue with farmers and crofters. We are still actively communicating to make sure that everyone who wants a loan can access a loan.

If about £400 million or £500 million is usually paid out by December, and 80 per cent of the loans have been paid to two thirds of the farmers, where is all the money? Who is holding it? Is it held within the Scottish Government or has it yet to come back from the EU?

My understanding is that the money sits within the Scottish Government budget.

The Scottish Government is holding on to the money.

We are not holding on to it. We have it there to be paid out. It is not doing anything other than any other money would be doing.

It is sitting in a bank.

It is sitting with those who have responsibility for accounts in the Scottish Government.

Is there any risk of farmers or crofters seeking damages or compensation from the Government for any material hardship that the delays or errors have caused them?

Although we have traditionally funded the payments in December, the legal requirement—and the penalty time—is that we should pay them by the end of June. Although farmers and crofters have traditionally come to expect their payments in December or in the early part of the year, as Mr Rumbles said, that is not a legal commitment, if you can call it that, of the programme.

I am sure that there is a risk. We understand it to be a low risk at this stage, but we are mindful that people feel cross and many are frustrated—

What is the legal commitment on the payment of the programme?

The payments are expected to be made before 30 June. The payments are not late in European Commission payment terms until after 30 June.

In 2017.

Yes.

That is a regulatory requirement in the Commission’s regulations—

But whether it is a legally enforceable one—

We would be advised to come back to the committee with more technical detail on that.

I am just not sure that I get the answer. It begs the question whether there are fines. When we last looked at the issue, there was contingent liability that if the money had not been paid by, I think, October of this year, a fine was a possibility. However, I understood that the convener’s question was whether a farmer who has been underpaid and has suffered as a result can bring a claim.

I cannot say that that is not possible. I was talking about the commitments that have been given. It is possible—and it is perhaps understandable—that people who are feeling frustrated and so on will want to ask how they can gain satisfaction on the matter. I cannot say that there will not be a legal challenge. I suppose that I was differentiating between the commitments that have been given and people’s decisions on whether to take civil action.

Are you aware of any farmers or NFU Scotland seeking legal advice on the matter?

I am not aware of that happening, but I will pass that question over to my colleagues, who are bit closer to the issue.

I am certainly not aware of any discussions that we have had on that with the NFUS. We should come back to you with any detail, because it is important to note that those of us who happen to be in the committee this morning are not up to speed with the technical and legal details. I do not want to mislead you in any way; we will offer you more information.

Thank you.

This project is one of a number of IT projects that have come before the committee over the years. Do we have an endemic lack of competence in handling IT projects? We have seen no evidence that the skills are there to do them. I realise that you have talked about what you are doing to improve that, but the evidence is not there.

There are two questions. One is about our performance on IT projects generally. I might pass to Anne Moises to talk about what we are doing to ensure that we have learned from that IT project—and indeed others—and what we have introduced, based on my commission at the end of last year of an IT assurance project.

We have delivered some very successful IT projects, but they do not get much air time, and I understand that. The last time that I was in front of the committee, when it was called the Public Audit Committee, I offered to send a list of the successful projects that we had undertaken and that were working well. I sent that list. It is probably not in your briefing pack, and I understand that as well.

We are not alone in finding large, complex and complicated IT projects difficult to deliver. The most recent evidence—Anne will keep me right here—is that about 6 per cent of large software delivery programmes are deemed successful and the rest are not. However, we cannot be complacent about that, which is one reason why, early in my time here, I commissioned Anne and colleagues to develop an IT assurance process for all our IT programmes, now and in the future. They drew on the learning from CAP, but not uniquely that, and looked at where to have mandatory elements and responsibilities and where to introduce stop-go gateways on key decision points in a project’s life. They also looked at what skills are needed, when to introduce those skills as early on in a project and programme design as possible, and where to source those skills from. As members know well, it is a tough market, particularly in Scotland, where we compete with the financial and other sectors to attract people to come to work for us.

We are not talking here about the technical skills of the IT person; we are talking about management competency. Some of the errors are so basic that they are breathtaking.

We are talking about a combination of skills: IT skills, commercial skills, contract management skills, programme management skills and, of course, management of people, which is the most important element of all. Those all combine into a team that needs to be in place at the beginning of a project. We have learned that not just from the CAP IT project but from others. There are a range of issues to do with the scoping of projects at their inception, which is a really key part, the pre-launch testing and our competence in the way in which we contract and hold to account contractors who deliver IT services for us.

Do our lawyers look at those contracts? In the particular case that we are discussing, a time and materials contract was put in place. Who thought that that was an intelligent thing to do for an IT contract? In a previous example, NHS 24, the contract was a complete shambles.

My understanding is that one reason why we went down the route that we did on this contract is because we had a very short amount of time to spec what the contract would have to do, and even less information on the breadth and nature of what that contract’s impact had to deliver. That was because of circumstances that we are familiar with to do with the way in which the project was brought into being and the regulations that we were subjected to by the EU. We had to have a particular kind of partnership contract because we could not find contractors who were willing to accept, alone, the level of risk that they might be exposed to, given the circumstances in which we brought together that particular service and that IT contract.

Earlier, I alluded to specifics in the birth of that project that made the choices quite limited on that score. I do not underestimate what we have learned from the project and others. The new assurance system that we are bringing to bear, which is being live tested now on some big projects that we have in the pipeline, will be fully rolled out to all the core Scottish Government and other agencies at the beginning of 2017.

Anne Moises can give a little more detail on the nature of that, if that would be useful.

Fine. However, I am a little alarmed that you seem to be positioning us for more bad news down the line. At the moment, are you aware of any issue that might come to the fore other than what happened yesterday?

Are you talking about information technology projects?

I am talking about the specific IT project that we are discussing.

I am not aware of any of those, but Anne Moises may want to talk about that.

I am not aware of any other impending issue with this particular project. However, as the permanent secretary said, through the assurance process we want to do a deep dive into some things that have already been delivered to ensure that they are fit for purpose and have flexibility and supportability built in to cope with changes that we are as yet unaware of as the process goes forward. We are undertaking reviews of a technical nature in the agriculture, food and rural communities futures programme, and that process will start shortly.

I will elaborate on that. That is a very specific piece of work that the cabinet secretary commissioned. It is a technical stock-take review to look at the IT system as it is now and to stress test it under several headings for gaps, any vulnerabilities and what options we might have to strengthen it, given what we know is ahead for the system in the future.

On Colin Beattie’s point about whether there are any more issues or errors, I cannot give a categoric assurance on that—I would be foolish if I did so—but the technical stock-take review, which we are appointing a supplier to undertake this week, I think, will give us a level of assurance about what we have at our hand currently and where we need to take additional action to ensure that we have greater assurance for the future.

Given the track record in the particular project that we are discussing and the clear deficiencies in its management, what has happened to the people who were responsible for the loss of public money?

No one person is responsible for that. No one significant failure has taken place.

No. It seems to be comprehensive.

There has been a difficult, complex, fast-moving and very stressful set of circumstances for people to manage, and there is undoubtedly a lot of learning to be drawn from that. That is why I am talking to the cabinet secretary in my role as principal accountable officer about undertaking a review of what has been learned from the very early stages of the project right the way through to the present day, and ensuring that that learning is put to good use in the project and across the Scottish Government for comparable delivery projects in the future.

So you are saying that nobody was responsible.

I am the principal accountable officer, and I have been since July of last year, so I am responsible for what the Scottish Government delivers and does not deliver. I do not say anything other than that I stand by that responsibility. My role and focus have been to ensure that we avoid any penalties where there was compliance with what we needed to do, and that we serve customers as best as we can in the confines of a project whose roots and origins none of us would have designed. In my time in the role, I am moving it on and committing to make the IT more stable—which it is—to stress test it and to ensure that the operational management has the skills, capacity, drive and pace that you heard about from Elinor Mitchell and Liz Ditchburn.

To give an example, Parliament works on the basis of performance-related pay. Has anyone had their performance-related payment withheld?

Senior civil servants in Scotland do not receive performance-related pay, although they do in Whitehall.

Has anyone been penalised at all?

There will always be an opportunity for a disciplinary process to be brought and for a disciplinary investigation if there is evidence of a person’s failure to carry out their job or a misdemeanour. However, I have not seen any evidence of a single point of failure. The review may bring up more information or evidence of what went wrong and how it went wrong. I am sure that there will be that.

I must say, however, that we have a massive amount of information. We have gateway reviews, the Audit Scotland reports and our own deep dives, some of which are still to take place. We also have a huge amount of information about the way in which the project was managed, about its governance and how it has been governed and about its assurance levels. All that information will be at our hand for a review, which I will be talking to the cabinet secretary about in short order.

10:00  

For every IT project that the committee has examined, there never seems to be anybody who is actually held responsible. It seems that they are redistributed elsewhere within the service, or they have moved on to something else and it is no longer their responsibility. That is frustrating. In the private sector, quite simply, there would be nobody standing. Given the size of the project and the loss to the public purse, it just would not happen. The frustrating thing is that there never seems to be anybody who is actually held responsible on a day-to-day basis.

You say that you are ultimately responsible, but that begs the point that there are people who are managing the thing on a day-to-day basis at various levels. We see the incompetence and the basic management failures—the basic questions that were not asked and the basic actions that were not taken—but nothing happens.

As I said, we need to differentiate between what happened at the outset of the project, which still resonates now—the way it was set up, the circumstances in which it was set up, the complexity that it was intended to deal with at the time and the very short amount of time that there was to deal with that—and what people have been doing in teams, as individuals, as the accountable officer and by way of programme management to put that right since then. They have been working as part of the operational, technical and delivery aspects. I am sure that you and others round the table will have seen the amount of time and effort that has been put in and the responsibility that has been placed at the area offices alone, as I have witnessed.

I have not seen any evidence of a single point of failure. For me, that is what would prompt a deeper dive into a disciplinary investigation. However, as I have said, I am talking to the cabinet secretary about a review to ensure that we squeeze out every bit of learning on every level—including on the points that you have raised—for the project.

Elinor Mitchell mentioned vacancies being filled. If I noted the figures correctly, about 40 vacancies were filled.

Yes.

Are we just throwing people at the project now?

Not at all. We consider the turnaround rates. The numbers that I mentioned include 24 agricultural office staff. There is a regular annual or biannual cycle to ensure that we have teams going through. There are also about 20 field inspector staff. That is in response to the new requirements under the new CAP system to do more land-based assessments. We are not at all throwing resources at the problem; we are ensuring that staff are able to take time off, get a break, take leave and do the jobs that they are being asked to do.

Permanent secretary, you have talked about a review of IT systems, but there is no mention of that in paragraph 4 of your submission. Why not?

As I said, we are in the process of getting together the requirements and skills to undertake that review. That is why I wanted to share it with you today.

Obviously, that review has not started yet.

No, it has not.

You are just preparing it.

Indeed.

That is why it was not in your paper. Were you preparing it at the time of submitting that paper?

Are you talking about the letter that I sent to you?

I am talking about the written submission from the Scottish Government dated 3 November.

Anne Moises will keep me right about the exact date, but we have been looking at how we best address a review of this kind and at the kinds of skills and circumstances that would make it most impactful. I cannot give you the exact date of when that was started and when that commission took place.

Okay. What are the comparable delivery projects in the future?

I will ask Anne Moises to talk about that. At the moment, the IT assurance programme is being applied in social security. We have a big project on e-counting, and Transport Scotland has an integrated ticketing project. Those are all areas where we want to ensure that we have good early use of the IT assurance programme. Anne Moises might want to elaborate on that.

We are applying the new IT assurance programme to major projects, which are those over £5 million. There are currently 16 of those in the central Government sector, and the full deep dive—the increased technical scrutiny and the stop-go gates—will be applied to them. The approach on digital-first standards, which is about user-centric design and trying to build the user experience into the system of IT design, will apply to all 304 projects across the central Government sector.

Sorry, but I missed part of that because a colleague was speaking to me. Did you say that there are 324 new projects?

There are 304 projects on what we call the information and communications technology risk register. We have asked all organisations in the central Government sector to give us foresight of projects that they are planning as well as information about projects that have already started or are in flight. Currently, there are 304 projects on that register.

Is social security one of those?

Yes, but it is a programme with a number of individual projects within it.

To follow on from what Colin Beattie was saying, my key concern is about the delivery of major IT programmes. If we cannot deliver the CAP payments, how on earth are we going to manage delivering social security? I know that the CAP system is complex, but it is far more complex to deal with the social security powers that are being transferred and the complexity of what we will have to deliver to such a large number of people. How can we have faith that social security will be delivered without any glitches or a full-blown crisis?

Anne Moises will talk about the nature of the assurance and the mandatory nature of what will be done, because it is not optional or something that people working in the Scottish Government and the wider domain can choose to apply—it is mandatory. However, there are two fundamental differences to note. First, I have already spoken about the particular circumstances and the specification of the CAP IT project, which was undertaken against a backdrop of late-changing and incredibly complex policy decisions. I am not suggesting that the social security programme is not more complex, but the birth of the CAP project was very compressed and was already building in a level of difficulty and vulnerability, given our lack of ability to specify something in sufficient detail. However, that circumstance is not in place for the social security system.

The second point is that we have prioritised work on how we make the transition in social security to ensure that there is no failure at the point of transition, and how much time we need for that. I know that that issue has been discussed in the Parliament recently. The approach is slightly different from the IT project for CAP, because we are taking on a series of customers and clients who are already receiving a level of service; and in order to ensure that that transition is smooth, we have been planning since the very earliest times of our consideration of the new powers how the transition can be phased in so that we have a much longer lead-in time.

We have learned the kind of skills that we need in the team and have recruited and are recruiting people with those skills to ensure that they are in the team at the beginning, even when we are just thinking about specifying. When we went out to get people with the skills that we want but failed to get them, we did not just appoint somebody on the basis that they would pick up the skills as they went along; we went back to square 1 and started looking again in order to ensure that we got the right skills and people with experience of the Department for Work and Pensions.

It is interesting, though, that I had to raise the point about social security. It was not included in the two short paragraphs in your written submission on “Lessons learned for future IT projects”. However, when I asked the First Minister at the recent Conveners Group meeting about cross-cutting themes in Audit Scotland reports, the first thing that she said was that we need to get things right for social security IT projects. I am a bit concerned that the paragraphs that are entitled “Lessons learned for future IT projects” have no mention of that at all. Perhaps you can give me assurances.

It is very high on my radar, as are all the new powers.

I have one final point, convener, as I know that you are pressed for time. The IT system that we introduced for Revenue Scotland—another example of new powers, although not of the same complexity as social security—is regarded as one of our great success stories. It has been quoted as such, not just by us, and its performance is award winning.

I have a couple of supplementary questions following the questions from Alex Neil and Colin Beattie.

In your statement to the committee, permanent secretary, you said that there is no guarantee of perfection. I am sure that everybody understands that a system, whether in the public or private sector, can never be wholly perfect; the important thing is to have a system that—although not perfect—commands confidence. Is there an acknowledgement that this incident further erodes confidence among the farming community, and that the goodwill that was created by the establishment of the loan scheme has now been undermined?

I will ask my colleagues to speak to that, because they are in more regular contact with the farming community than I am.

Anything negative that follows a positive will carry the risk of undermining that positive. I urge everyone to ensure that, when we engage with stakeholders, the industry and the broader public, we always seek to put things in context, so that the scale and the nature of errors are seen for what they are, and that we do not let the errors become more of a risk to confidence than they should be. I accept that it cannot be positive to see something apparently move in the wrong direction. It is important that we all try to maintain a picture of the context around the nature of the good things and the more challenging things.

My colleague Alex Neil said that it was very easy to say sorry and to say that lessons have been learned, but his question was about accountability. The committee has been advised that, in this case, there was human error and a miscalculation of the exchange rate.

In relation to confidence and about restoring that confidence, you talked about some of the short-term measures that have been put in place. Regarding longer-term measures further into the future, what steps will you take to identify risk and to ensure that the risk is reported to ministers? For example, is there any form of continuing professional development for existing staff, and how robust is the training programme that the new staff who are now coming in and filling vacancies go through? Are the measures that you will put in place robust enough to militate against such incidents and mistakes happening again?

I will cover each of those points in turn.

As I have already mentioned, I have asked whether we can be part of a Scottish Government-wide pilot on reviewing how we look at risk. We are actively reviewing our risk register to ensure that we capture risks, escalate them and deal with them at the appropriate time.

Picking up on the recommendations that were made in the Audit Scotland report, my overall sense of governance more generally is that governance was in place, but that it did not look at the system as a whole; rather, it looked at individual workstreams or projects. We are refining the governance arrangements to ensure that we look at all aspects of the system—IT and operational aspects together—so that we can give the appropriate assurance to farmers and all our customers that we are doing the right things at the best times and that we are talking to people.

On CPD, there are a number of mandatory training programmes in place and, this morning, I wrote to all staff in the directorate, asking them to ensure that they have undertaken the mandatory training on data handling and to complete that training this week. There is a clear and agreed training programme for area office staff when they are brought into the organisation. We also have leadership management development programmes in the directorate, which we are currently reviewing.

I think that your final point was about measurement and the progress that we are making. Linked to the governance work that we are doing is our development of a range of management information metrics so that we are better able to see and understand the areas in which we are making progress at the pace that we want and the areas that we want to focus attention on in the future.

10:15  

Thank you for that. My next question is about risk, and Scottish Government-wide analysis of risk. Do you have your own risk register for your directorate? How is information from that communicated to ministers so that they are aware of impending issues? Is there a dashboard that flags up to ministers that something is amber or red and therefore of real concern?

There are a range of escalation processes. As I said, there are risk registers at project and workstream level, and they are escalated to divisional and directorate level and then to the Scottish Government-wide risk register. We use a well-known and well-regarded way of measuring risk and categorising it into red, amber and green. I have regular meetings with the cabinet secretary and I always undertake to ensure that anything that is highlighted as a red risk is discussed with him.

In response to a question from Alex Neil, the permanent secretary mentioned that staff are happier than they were before. What has been the participation rate in surveys of staff views? In some councils, participation in such surveys has been declining. Has there been a decline in people participating in staff surveys and questionnaires?

I will ask Nicky Richards to talk about that, but there has certainly not been a decline in participation rates in the Scottish Government. We are doing everything that we can to increase them because surveys are such an important source, not just across the Government but in more granular circumstances. We have started to break them down by deputy director so that the deputy directors know how their staff feel.

Across the Scottish Government as a whole, the response rate is very good. It tends to be about 73 per cent—that has stayed fairly constant over the years. We do the survey every year. Within the agriculture, food and rural communities directorate, which Elinor Mitchell leads, the response rate went up from 54 per cent last year to 61 per cent this year, so we have seen quite a good increase, which I think is really positive.

At an SG level, the range of scores remained quite static, without a huge change on last year, but the directorate bucked that trend with quite a few positive increases. We are particularly alert to the scores around having an acceptable workload, which increased by 13 per cent within the payments and inspections team. That significant uplift shows that people are finding their work more manageable and are able to see a way through.

As ever, there is lots to work on, but the fact that bullying and harassment scores went down and that people can see a way through in how they work with others in their team to come up with new ideas is encouraging. It is about cultural shift and how we encourage people to speak up when things are going wrong and to seek support from others. When a team has been really up against it for a long time, it can be quite hard for people to do that, but we are seeing at least some encouraging signs there.

My next question follows on from Colin Beattie’s questions about who is ultimately responsible, whether anyone has been held to account and disciplinary processes. As an example, I used to work—forgive me for it—for the Bank of Scotland, and we handled lots of sums of money. Sometimes that involved going into personal accounts and paying the deposits for people’s mortgages. This was in Aberdeen, and at that time the sums could be significant, especially in the case of mortgage proposals. If anything went wrong and I made a mistake, I could bet my bottom dollar that I would be wheeched into a disciplinary process very quickly. Given that we have identified that there is human error, what disciplinary process has been enacted? I cannot understand why nothing has happened to date and nothing has been identified.

We have spoken about the most recent issue, which was the data handling issue, and I think that Elinor Mitchell talked about the fact that she is undertaking an investigation to find out why that happened. That process would trigger whether there was a requirement for disciplinary activity—if one person or several people had been seen to be clearly failing in their duty and their responsibility.

We take performance management very seriously. I have been in the same position as you. I have worked in other organisations and undertaken the disciplinary process, and I have sacked people. This is not about whether we decide that we think that it is a good thing, or whether we have a taste for it; this is about appropriate performance management that takes place early on—to go back to your earlier point—in order to ensure that people have the right skills and tools for the job and that we are investing in those individuals.

However, as I said earlier, if, as part of the review that I am discussing with the cabinet secretary, evidence that I have not been party to comes to light that gives us greater understanding of the issues and shows a single point of failure, that would trigger another piece of work that would include us looking at our performance management and disciplinary routes.

On pages 35 and 36, the Audit Scotland report highlights the conflicts of interest that were not dealt with effectively. It says that the Scottish Government did not consider any conflicts of interest until 2014, when a whistleblower alerted the Scottish Government to the fact that the delivery director provided CGI and the Scottish Government with staff. It seems that, even after the Scottish Government was notified of the delivery director’s conflict of interest, he was still able to sit on a resources group. It then took eight months for that conflict of interest to be formally recorded. Can you explain that? Why were processes not already in place? Who was responsible for ensuring that they should have been? What safeguards will be put in place to prevent that from happening again?

I will ask Nicky Richards to talk a little bit more about the policy and processes.

As you will be aware, there are areas at the moment that are subject to live police investigation, so I cannot talk about them in any detail. It might be possible to have a private conversation with the convener subsequently, if you want to pursue the issue.

Once it became aware of the potential conflict of interest, the Scottish Government kept the individual on but amended the recruitment procedures from summer 2015, so that the decisions were taken by a panel, not by an individual. Further, a conflict of interest registration rule will apply to all future senior staff, including contractors. I believe that that was not complied with at the time of the appointment that we are talking about.

I reiterate that, given that a live police investigation is under way, we will have to come back to this issue at a later date.

Lessons have been learned in relation to our whistleblowing policy and conflicts of interest, particularly with regard to the performance management of contractors and the need to be clear about the responsibilities that contractors have when they work alongside civil servants. A range of work has been done in that regard. We have been working with our counter-fraud group to understand what more we can do. We have reviewed all our whistleblowing policies and are taking those forward. In particular, we are trying to build a much clearer link between whistleblowing and awareness of fraud, in relation to the taking forward of fraud investigations.

We have just talked about the processes that are in place around risk registers. The Scottish Government was made aware of the conflict of interest by a whistleblower. Was such a conflict of interest ever registered as a risk? How was it monitored?

I cannot speak about that individual instance or give you a categoric answer. I would have to go back into the records to find out. Clearly, that risk affects all projects. Given the strengthening of the processes that Nicky Richards talked about, it is something that we need to ensure is taken into account appropriately in future.

It would be helpful if you could check the records and get back to the committee.

When did the governance board last meet?

Under the new governance and assurance processes that were introduced earlier this year, there are now two tiers of programme management boards. Liz Ditchburn can talk about the differences between them. One of them met recently, at the beginning of December.

How many times has it met this year?

Elinor Mitchell has a better grip on the data than I do, but we have transitioned since the last time that I appeared before the committee. At that point, we were just about to make the change, having agreed the new structure.

Since I have been in the job—since May—I have been to a number of programme boards. I am not sure that any of us has the detail of the number in our heads, but we had much more frequent programme boards over the summer, particularly in the run-up to the June deadline. At the end of the summer, we then transitioned to the new structure, under which there is an executive steering committee, which sits on top of the programme board. I chair the executive steering committee, which met for the first time last week. Elinor Mitchell chairs the programme board, which I think meets—

Fortnightly. Since I have been in post, there has been one executive steering committee meeting, which was last week, and three programme boards. The latest one was yesterday afternoon.

Since the Auditor General picked up the governance issues in her report, have all key decisions been made by either the governance board or the programme board, or have they been made by any other means?

Since I have been in post, all key decisions have been taken at the appropriate governance levels.

But you have been in post for only 11 weeks. Is that right?

Yes.

So what about before that? The Auditor General’s report was published in May.

Yes, it was. She made a clear point and expressed concern about how one or two particular decisions had been taken outwith traditional governance and programme governance. That partly informed the comments that have been made today and elsewhere. The revision of governance and assurance arrangements in the programme came in on the tail lights of a complete change in governance and assurance in the Scottish Government that has recently been introduced at my instigation. I cannot comment on any decisions being taken outside that in the programme, but that would be unusual and out of keeping with what the new governance and assurance process was intended to include.

It would be good to know a bit more about what you are particularly interested in, convener, but there are two categories of decision that would not necessarily be taken in the programme board discussions. One is to do with issues that are discussed and analysed at the programme board and are then escalated to ministers for their decision, with recommendations. For example, the decision to offer a loan scheme for 2016 was taken by ministers on the basis of advice from officials. Of course, because of the financial implications, that decision was not just for the Cabinet Secretary for Rural Economy and Connectivity but very much for the Cabinet Secretary for Finance and the Constitution. There are definitely decisions that come through the programme board structure and are escalated for ministerial decision.

There are also small operational decisions that are necessarily taken between meetings at an appropriate level. Those are taken on an on-going basis. For example, as we were running the control room on a daily basis through the run-up to the 30 June deadline, operational decisions would have been taken, and the impact of those would be relayed back to the programme board. Obviously, decisions are taken outwith the programme governance structures, and appropriately so.

Okay, but the Auditor General said:

“Significant decisions were made outwith programme governance structures”.

Are you telling me that that is no longer happening?

I am confident that that is no longer happening.

Thank you.

To follow up Ross Thomson’s question, am I correct that there is a live police investigation going on into the previous issue with contractors?

Yes.

Are you confident that there are governance arrangements in place so that in future we do not have contractors that have been taken on by the Scottish Government under investigation by the police and fraud teams? Frankly, that is extremely worrying.

That goes back to our earlier conversation. We cannot talk about it in detail, because of the nature of the investigation. We have a whistleblowing policy and we have strengthened it in relation to arm’s-length organisations and particularly contractual bodies.

I have a couple of supplemental points. I mentioned fines being levied as a result of late payments. Can you assure us that that will not happen and that we will not be fined for late payments in the current run?

I will ask Elinor Mitchell to talk a little about where we are in the cycle, because we do not know yet. As we have said, we would like to give as much confidence as we can in relation to delivery performance. There will be some audit work and conversations because the issue is not just to do with us—the fines and late payments system operates across the UK. We are as confident as we can be, but I cannot give you a categoric assurance about that. I would be foolish to do so.

I do not know whether Elinor wants to say something about where we are and when we are likely to know in response to the root of your question about whether there may be penalties for late payments.

10:30  

As the committee is aware, the usual payment period is to 30 June. In a normal cycle, there is the ability to make payments between 30 June and 15 October. For this year only, the penalty-free payment period was extended to 15 October. By 15 October, Scotland had paid, by value, 99.9 per cent of all our cases. For the 0.1 per cent that we had not paid at that time—the 46 outstanding cases—there will be disallowance. I understand that we get disallowance of between 1 and 2 per cent every year.

The position on penalties is not yet clear because it is a member state issue and not a Scotland decision. We are working with the UK co-ordinating body to make sure that we have final and accurate information—it is quite a complex calculation—on the basis of what progress had been made by 30 June and by 15 October and, therefore, whether the European Union will determine that there are any fines to be made. We are not at that position yet; we do not have the final information across the four parts of the United Kingdom.

Do you have any idea how much the fine could be? Have you made provision should the worst happen?

We have estimates of the worst-case scenario, but it depends on a number of factors. It depends on whether Scotland is liable or whether it is liable jointly with England or other parts of the UK, and it also depends on the progress of other parts of the United Kingdom in making all payments by the end of October. If you want to know the number, we estimate that the maximum penalty would be about €5 million.

Sticking with fines and sanctions, I note that a data protection issue has been mentioned. That topic is not particularly within my ken, but I think that there is a possible sanction of half a million pounds for a data protection breach. Is that correct? If so, what is the risk of a fine for the breach?

Anne Moises is the person to talk to on that subject.

The Information Commissioner can award significant fines. The breach was of email addresses only. It was personal information, but it is not the type of sensitive personal information that the Information Commissioner has historically awarded fines for. That tends to happen in cases of large breaches where names, addresses and, particularly, financial information are shared inappropriately, or hacked. I am talking about a TalkTalk scenario and not a case where email addresses have been shared inappropriately.

It is highly unlikely that a fine would come from the Information Commissioner’s Office in this case. I would not like to prejudge what her office will say, but it is more likely that it will ask us to ensure that our data protection training is completely current and to prove that we have put in place processes to minimise the likelihood of anything like that occurring again.

There has to be an argument that the data is indeed sensitive. It may be email addresses that have been disclosed but, by definition, the breach has disclosed that those are people, if I understand you right, who—

Some belong to businesses.

Those people and businesses are in a situation where they require to apply for loans.

No. Let me clarify. The data handling issue relates to farmers who have applied for the beef efficiency scheme, which is a CAP pillar 2 scheme. It is completely separate from the loan scheme and has nothing to do with that. There have been no data issues at all that we are aware of on the loan scheme. In addition, we are talking not about the 18,000 farmers who are applying for basic payments but about the category of farmers who have explicitly applied for the beef efficiency scheme. It is limited to them.

Right. I have a final thought. Given all the problems that have been going on for three, four or five years, why has it taken such a significant data breach for the training to be instigated?

The training has been a requirement for all Scottish Government staff for a significant number of years. It was introduced shortly after the large Inland Revenue data loss some years ago. It is a standing requirement on Scottish Government staff to refresh their training on data protection every year.

In that case, it does not work, does it? There has just been another breach. What lessons have been learned from the previous event? With respect, Leslie Evans said right at the start that lessons have been learned, and I suggested that it may appear that lessons have not been learned. Is this not another example of that?

Part of my investigation into what has happened will be to determine whether the individual or individuals involved have done their mandatory annual training. As I said, I sent an email round to all staff this morning to remind them of the requirement to do the training and to ensure that everyone who has not done it this year does it by close of play tomorrow. Part of my investigation into what has happened is to find out whether the individuals involved have done the training and, if they have had the training and it has not been successful, what further training requirements they have.

I will leave it there.

I would like to go right back to the start. At our previous meeting, Liz Ditchburn helpfully explained how the new CAP policy works and the regulations from the European Commission, and Jonathan Pryce explained:

“We had concerns about the complexity and we discussed all of that but, at the end of the day, we still went for three payment regions.”—[Official Report, Public Audit Committee, 29 September 2016; c 34.]

He also explained that the Welsh and the Northern Irish use a single region. At what point did you realise that using the three payment regions would cause such problems? Were you too far in to change the system at that point?

I was not involved at that time, but I know that the risks that were associated with the Scottish policy response to the EU regulations—namely, to go for three regions—were discussed in the team that was responsible, with ministers and indeed with stakeholders. It was from the early stages of taking the decision—or prior to taking it—that the associated risks were flushed out and understood.

In hindsight, did we know at the time the level of risk that that would expose us to? I think that Graeme Dickson, who was the previous accountable officer, was in front of the PAC just over a year ago, and he had been in front of it the year before acknowledging that not knowing what the scheme might entail meant that there was an underestimation of what the IT system would cost and the complexity that it was going to have to deal with. However, there was awareness among all parts of the involved parties of the level of risk. There may have been an underestimation of how the risk might play out, but it was acknowledged.

Okay. I was interested to hear Nicola Richards’s answer to Ross Thomson’s question about the staff. I find it reassuring but almost unbelievable that staff are saying that they are happy with their workload given the amount of extra work, pressure and stress that this has undoubtedly caused them. The staff on the front line in the area offices have had to deal with a lot of—let us face it—angry farmers. The mistakes that we have been hearing about have put a lot of pressure on them. Do you offer staff anything extra in the way of support or advice in these stressful times?

Liz Ditchburn might want to comment on the point about risk, but I can answer your question about the staff. Nicky Richards might also want to come in on that.

Two levels of support are available for staff who encounter such issues—and many do, given the nature of public service and what the Scottish Government does. First, at the corporate level, there is a Scottish Government wellbeing policy and an employee assistance service, and we put in place a customer helpline to try to help to mitigate the pressures on front-line staff. Locally, staff have monthly conversations with their line managers, and the people survey tests how many of those monthly conversations are taking place and how useful they are to staff.

Secondly, there is pastoral care. All our managers, but particularly those at the deputy director and director levels, are acutely aware of the importance of getting out and hearing from staff and trying to resolve the barriers and irritations that often make the difference between staff feeling that work is stretching but enjoyable and staff feeling differently.

I am encouraged by what I am reading in the survey results, but I am in no way complacent about that. We have to understand that it takes only one or two people in the team to feel at the edge or stressed about their work for the culture to change.

We have rightly talked about the technical, contractual and skills aspects, but we have learned that there is also a cultural aspect to how we manage big, operational, front-facing delivery programmes, and that is also relevant to social security and other programmes. As a Government, we are increasingly moving into undertaking direct operational delivery functions of the kind that one sees regularly in Whitehall but that have not been so much to the fore in the Scottish Government. Part of my responsibility is to ensure that some of the changes that I am introducing in how we introduce talent and skill people up reflects that shift in responsibility and the shift to an outward focus.

I do not know whether we have time for Nicky Richards to say more.

We are running short of time, but she can add something if she wants.

I do not have anything specific to add, but I think that Elinor Mitchell does.

Is it additional information?

Yes. On this year’s people survey results, I have already engaged all staff across the directorate in a conversation about what we need to do and what they want us to do together to make it a better place to work and to make them feel happier and more supported in what they do. Those conversations have already started.

That is good. Finally, can you reassure us that, next time the Auditor General does an audit report on the CAP programme, things will be better than the current one shows?

I believe that the next report will record that improvements have taken place since the previous one.

Thank you.

I have a final question on management. Elinor, you said that you have 20 vacancies to fill in your team. That is quite a lot. Are they all at a senior level?

No. A number of vacancies come up regularly, every year, because of the staffing in area offices. I was referring to the area office staff jobs that reflect the new workload.

I see. Am I correct to say that your predecessor was Jonathan Pryce?

Yes.

He came to give evidence to the committee 10 weeks ago. I think that you have been in post for 11 weeks. Was Jonathan Pryce no longer working for the Scottish Government when he came to give evidence?

Let me clarify. He had already moved post, but we informed the committee through the clerk that, in our view, Jonathan Pryce was the most appropriate person to come and give evidence at that time because he had all the required knowledge. We informed the committee that, although he had just moved on to a new post and his successor was in place, we felt that it would not be appropriate to ask her to come to the committee at that time.

So he is elsewhere in the Scottish Government.

Yes.

Okay. I thank you all for your evidence this morning. As Gail Ross said, there are huge issues here involving police investigation, the fraud team, overspend, errors and potential fines. I wish you all the best of luck in making the progress that is needed to ensure that we do not have this situation again.

The committee will now move into private session.

10:44 Meeting continued in private until 10:57.