Official Report

Good afternoon, and welcome to the second meeting in 2020 of the Scottish Commission for Public Audit. I ask members and witnesses to be concise and to the point.

We have received apologies from Alison Johnstone MSP.

Agenda item 1 is a declaration of interests. I welcome Anas Sarwar, who joins us in his capacity as acting convener of the Public Audit and Post-legislative Scrutiny Committee. Anas, do you have any interests relevant to the remit of the commission to declare?

Good afternoon, chair. It is good to be part of the commission. I have no interests to declare.

Thank you.

Agenda item 2 is a decision on taking business in private. The commission is invited to take in private item 4, which is consideration of evidence heard. Is the commission agreed?

I will take silence as agreement, so that is agreed.

Agenda item 3 is Audit Scotland’s annual report and accounts for 2019-20. Members have copies of those, as well as a management letter from Alexander Sloan, in their meeting papers. I welcome to the meeting Alan Alexander, chair of the board of Audit Scotland. I think that this is his first meeting of the SCPA as chair of the board. Alan is accompanied by Caroline Gardner, Auditor General for Scotland; Diane McGiffen, chief operating officer, Audit Scotland; and Stuart Dennis, corporate finance manager, Audit Scotland.

Today is Caroline Gardner’s last appearance in front of the commission before she demits office. I put on record the commission’s thanks to you, Caroline, and our appreciation for your work as Auditor General over the past eight years, for which period I have been in the chair and dealing with you. Thank you for your excellent participation and engagement with the SCPA, which is greatly appreciated. Thank you for your engagement with the Parliament in general, with the Public Audit and Post-legislative Scrutiny Committee and, more widely, your involvement in the work of the Scottish Parliament’s budget review group.

Before we move to questions, I remind everyone that, because of the challenges of managing a virtual meeting, we will take questions in a prearranged order. If any member has a supplementary question, please type an R in the chat box, and I will bring you in as soon as I can. As always, I will be grateful for succinct questions and answers. Please give broadcasting staff a few seconds to operate your microphones before beginning to speak.

I ask Alan Alexander and the Auditor General to make some short introductory remarks.

Thank you, chair. As we are acutely aware, in the past few months of 2020, the world has changed profoundly. Due to the Covid-19 pandemic, public bodies and public services have been operating, and continue to operate, under tremendous pressure. Like others, I am immensely grateful for the work across the public sector to help us through the crisis.

For Audit Scotland, Covid-19 and the measures taken to contain it have meant rapid and massive changes to the way that we work and the way that our colleagues live. In the course of 24 hours in mid-March, we changed from an office-based operation to a virtual one. I place on record my thanks to and respect for the staff of Audit Scotland for their agility, professionalism, dedication and good humour during the most significant upheaval that we have seen in our lifetimes. Our priority has been the safety and wellbeing of our colleagues. The board has focused on ensuring good governance and oversight in those new ways of working, and that will continue to evolve.

As a board, our role is to oversee the exercise of all functions of Audit Scotland. Audit Scotland supports the Accounts Commission and the Auditor General. We provide independent assurance to the people of Scotland that public money is spent properly and provides value for money. To do that, we must do three things: safeguard our independence; uphold the quality of the audit; and ensure that we focus on the issues that really matter and which will improve the services that people across Scotland use and rely upon daily.

In a moment, I will hand over to the Auditor General, who is, as you know, also Audit Scotland’s accountable officer, to make her opening remarks. Before that, it is important to highlight that this is a time of transition for Audit Scotland’s board and the organisation. As you mentioned at the beginning, chair, this is my first meeting with the commission since coming into post as chair of the board of Audit Scotland in April. I would like to thank my predecessor, Iain Leitch, for his stewardship over the past five years.

Two other board members will finish their terms in the coming months. Graham Sharp is stepping down as chair of the Accounts Commission, with Elma Murray coming on to the board as the interim Accounts Commission chair. Non-executive member Heather Logan, who is chair of the Audit Scotland audit committee, will end her term in September. I thank Graham and Heather for their contributions and wish them the best for the future. I should also say that we look forward to welcoming the two new independent board members as soon as their names can be given to us.

Turning briefly to Audit Scotland and the Auditor General, Caroline Gardner’s eight-year term comes to an end this month. Caroline has been an exceptional Auditor General. Anyone who has worked with her or encountered her can attest to her professionalism, expertise and insight, as well as to the fact that she has that crucial quality of empathy. As accountable officer for Audit Scotland, she has been a superb and well-respected leader. Caroline, thank you for all that you have done. I am sure that we will continue to see you make a significant contribution to Scotland and its public life in years to come, whatever you decide to do next.

With that, I hand over to Caroline to make her opening statement.

Thank you, Alan, and to the chair, for your kind words, which are much appreciated.

I would normally use this opportunity to look back at the performance and achievements of the past 12 months. Instead, I start by paying tribute to Scotland’s public services and all the people working to save lives, support communities and protect jobs. Covid-19 has put our society under tremendous strain, and it will be some time before we understand the full impact.

In those circumstances, good governance and financial management are more important than ever, and we are acutely aware of the pressures and limitations under which public bodies are working. Our response is and will be to ensure that audit is flexible, pragmatic and consistent. We are working through our priorities and our work programme to ensure that we can deliver a strong audit service to the Parliament and focus on the issues that matter.

However, it is important to remember that the pandemic comes when public services are already facing a good deal of pressure and uncertainty. Demands and expectations continue to rise, alongside static or reducing budgets, and the public sector has had to prepare for the prospect of the United Kingdom’s withdrawal from the European Union and the associated uncertainty. At Audit Scotland, we have sought to ensure that we have the capacity to meet our growing responsibilities and to continue to deliver high-quality audit work. Covid-19 means that we have also had to change how we operate, and that will continue to evolve.

Finally, as I end my term as Auditor General, I would like to say thank you to my Audit Scotland colleagues. Over the past eight years, I have been proud every day of their professionalism, their commitment to improving public services and their resilience, and never more so than in recent months. I thank them all for their support and friendship. I also thank the Scottish Commission for Public Audit for the important role that it plays in supporting a public audit regime in Scotland of which we can all be proud.

As always, chair, we are happy to answer your questions.

Thank you. On page 9 of the annual report, Audit Scotland states that it has started to implement its digital audit strategy, including introducing data analytics and employing the first dedicated digital auditor. How will data analytics enhance audit techniques, and will that result in a more efficient and cost-effective audit process?

I will start, before I hand over to Diane McGiffen. As the commission knows, we have been investing in our digital capability for a number of years, with your support. That investment has been critical in enabling us to pivot to remote and virtual working, as of mid-March this year. The data analytics strategy predates the pandemic, and aims to look at what we audit—the investment that is being made in digital technology by the public bodies that we audit—and how we do it, to ensure that we can use digital technology to look in a more wide-ranging and less sample-focused way at the records and approaches that are taken by audited bodies. Diane—could you amplify that for the commission, please?

Thank you, and good afternoon, members.

As the Auditor General said, we have been investing in digital technology for some time, with a twin-track approach. Our digital capacity—our infrastructure—has enabled us to move overnight, as the chair of the board said, to work entirely virtually. Our digital auditing strategy has been developed and progressed through our performance audit work programme, the outputs of which the Public Audit and Post-legislative Scrutiny Committee has considered several times, and through our audit methodologies.

We are now taking stock of a range of improvement projects, given the disruption that Covid has brought to all our work. We intend to bring even more closely together our digital services capacity and our digital auditing capacity, so that our auditors can work online first if they need to, and so that we can advance some of the audit methodology and audit technology projects that we had started, whose delivery has perhaps become more urgent.

We have strengthened our staffing, and we have employed a key specialist. We have enhanced our data analytics training for all colleagues, which was a feature of our learning and development programme last year. Within the organisation, we have also been building our networks of digital interest and expertise, led by some other teams that are skilled in the area. We have also developed an extensive programme of speaking to public bodies about our work. We are well connected in the digital arena, and we see it as an area of work that we will continue to grow. I hope that that is helpful. I am happy to answer any questions.

Thank you. You say that you have your first dedicated digital auditor. What other dedicated staff do you have on the digital side? As you said, you have been investing in this area over the years, quite rightly. In previous years, you assured us that your ability to audit information technology and digital services was being enhanced year on year and was at a reasonable level. What is Audit Scotland’s overall capability? How many dedicated staff do you have?

We have a team of computer auditors, who have worked in a traditional way, auditing the IT systems and the risks that are associated with those in all the bodies that we audit.

However, as Diane said, over the past couple of years, our digital strategy has been focused on ensuring that all our audit staff have greater digital awareness and skills, because so many of the public services that we audit now rely on digital technology. We are following closely developments in use of data analytics to carry out audit work, and we are building up our capacity and skills in that area. As the annual report says, our digital audit team is moving to being much more focused on how public services are provided through digital platforms rather than on IT systems, in the way that they would have been provided in the past.

We are building the data analytics capacity to ensure that staff who already have an interest and skills in that area have a professional grouping and a professional home within the organisation. We are trying to ensure that we can resource our work in flexible ways in order to make best use of those skills to reflect the particular circumstances and risks that we see in each of the audited bodies.

The number of staff involved as specialists is relatively small—there are fewer than 10. However, we are looking to get the most leverage from those staff to ensure that they are working directly on the audits with the most significant risks and opportunities, and that their skills are available to all our staff who are involved in audit work, because we now deal with few things that do not have a digital dimension at least, even if they are not fully digital. That has ramped up significantly over the past three months.

Thank you. As Rona Mackay will have to leave the meeting early for parliamentary business, I invite her to ask her questions now.

Thank you, chair. Good afternoon, panel. Professor Alexander, you said in your opening statement that one of the key responsibilities of Audit Scotland is to uphold the quality of audits. According to the paper, “Quality of public audit in Scotland: Annual report 2019/20”, which was published earlier this month, only 25 per cent of Audit Scotland staff feel that they have had the time and resources that are required to deliver a high-quality audit. That is a significant decline, from over 60 per cent in 2016-17, when the information was first recorded and reported. What measures is Audit Scotland taking to address the concerns of the majority of the staff of its in-house teams?

Thank you for the question. Let me answer it from the point of view of the board’s oversight, and I will then hand over to Diane McGiffen to provide you with the detail that you have asked for. The board monitors such issues closely, as does the remuneration committee, which I chaired until recently, and the Audit Scotland audit committee. When there has been an apparent drop of that sort, we assure ourselves that management action is being taken in a targeted and effective way to ensure that we deal with any problems that that produces for the audit. I hope that it is acceptable for me to hand over to Diane to provide the commission with some detail.

Thank you for the question. Please be assured that we considered the results carefully, and that we take them seriously.

It was disappointing, but sadly not unexpected, that people felt under pressure last year to deliver audit work. We knew that there was pressure in the system, and we had taken action to resolve that. What the survey shows is that the action did not have an impact in time for the peak in audits, for which we are very sorry. However, we are also very grateful to our colleagues for their work under difficult circumstances.

I will give you a flavour of those actions. We have been working to keep establishment levels high and to fill vacancies quickly. One of the pressures last year was driven by our expansion. On the positive side for colleagues, many opportunities arose because of the new financial powers work, and many colleagues were promoted and took up new roles. That left some vacancies and gaps. We filled those, but that took us longer than expected. However, we have increased recruitment to maintain establishment at a high level.

Peak auditing times represent a particular pressure for colleagues. We have taken into account all the factors that cause pressures, including through consideration of the timing of recruitment and appointment to professional trainee schemes; engagement of student placements; on-going work on creating a pool of colleagues who can work with us on a seasonal basis, rather than our using agency staff; and consideration of opportunities for former colleagues to work with us on a restricted basis. However, those measures, which we have been working on diligently for this summer’s peak, might not be the measures that will help us through the peaks of work that might result from the disruption to our work planning that is caused by Covid. We are keeping that under review.

We recognise that we need more agile movement between teams. An issue last year was that some small teams were hit by difficult sets of circumstances, and we were unable to find adequate resourcing solutions quickly. We are now geared up to move more quickly on that.

We have been working closely with our health and safety committee and with the Public and Commercial Services Union to address resourcing issues throughout the year. We had a small team that led a project to examine all the possible options to improve resourcing this year, and many good actions came out of that. However, as I said, because of the disruption that has been caused by Covid, we are not sure that we will take all of those actions over the expected peaks of work this year.

Thank you. When you refer to “resourcing issues”, are you talking about staffing issues? Are you satisfied that those issues have been resolved, to an extent? I hear you say that things might not be ready for this summer, but can you clarify exactly what you mean by “resourcing issues”?

Thank you. We are talking about the people we have and the demands upon us—the two parts of the equation. We have looked at both parts and tried to eliminate or pause work that is not currently necessary. We are going through a huge reprioritisation process anyway to enable us to deliver accounts for the year, but we had already started to look quite critically at the demands on us and how we could better meet those or pause some of them, and we had also started to consider all the resourcing and people we have, what they are doing and how we are phasing and managing all that.

Bill Bowman has a quick supplementary question.

In a similar vein, Audit Scotland has recorded an underspend of £24,000 against its training budget this year, and the actual figure reduced marginally on the previous year. The previously mentioned report, “Quality of public audit in Scotland”, stated that 60 per cent of the staff of Audit Scotland’s in-house teams felt that they had enough training and development to enable them to deliver a high-quality audit. Apparently, that is the lowest rate of all public audit providers included in the survey. Therefore, does the 2019-20 underspend on training contribute to the responses of staff, in respect of their personal and professional training and development? What measures are in place or being planned to address the feedback from your in-house teams?

I ask Diane McGiffen to answer that question.

One factor that reduced the number of training days last year was that we moved our all-staff conference to this financial year. That represents one day of training for every member of staff, because it covers technical and other matters. Last year, because of the resource pressures that we were experiencing in some areas, which I referred to in my earlier answer, we also rescheduled some training and paused some training so that people were not having to choose between making their audit contribution and delivering training courses. We are catching up with all that. We moved several training events online at the end of last year. There are some differences in how we and all the firms record training, but we take the trend very seriously and we are looking at that.

We have a strong programme of professional development and support. This week, the Institute of Chartered Accountants of Scotland delivered an online training session for all staff on the basis of the reviews that it has done of audits. That is under review. We are keen to explore the opportunities that operating virtually can give us to enhance training, but we are confident that we are meeting most of the training needs that have been identified through our performance development programme and 3D conversations. We are trying to balance that with resource demands.

Page 42 of your report states:

“Over the year, staff received an average of 7.7 days formal learning and development per person.”

If you take a five-day week, I suppose that that represents 1.5 weeks. Does that include all your students? They would seem to get more training.

I do not think that that includes the students. I think that that is calculated separately, but I can come back to you with details of that.

The report does not make that clear, and it does not give any comparisons. If that is an average, the worry is that some people get more training than that and some people get very little training. Is that the case?

There will be variance, as you would expect, but we have a comprehensive training programme covering professional development, career development and other items. We delivered a lot of learning and development last year. There have been a lot of changes in the professional requirements, and we have been following that up. We consider the training needs of teams, and we have been having discussions with teams about their views on training and so on. Therefore, we are engaging strongly with the issue and looking to offer a comprehensive mix of training for colleagues, balancing that with the pressures.

More information on the figure of 7.7 days would be helpful. I have delivered training in the past, and it is not just about delivering training; it is about the feedback you get, how well it is taken on and the uptake by trainees.

Moving on to a couple of other issues, on page 2, under the heading “About us”, you say:

“Our vision is to be a world-class audit organisation that improves the use of public money.”

You use the term “world-class” quite often in the report. What is a world-class audit organisation, and are you one?

I will start on that question. That has been our vision as an organisation for, I think, at least five years now. It has two dimensions, which we monitor carefully. The first is ensuring that our audit quality framework is absolutely compliant with international standards on auditing and with the International Organization of Supreme Audit Institutions’ standards of supreme audit institutions for performance audit work. We are unique among the UK public audit agencies in having a comprehensive audit quality framework that covers all our audit work—financial, performance and best-value audit work—whether that is carried out by Audit Scotland teams or by firms that the Accounts Commission and I appoint to carry out audit work. We report the results of that annually. You will see from our annual report that our results are good and improving. We have a solid assurance that we are meeting those standards and learning from the feedback from the independent reviews that are carried out by ICAS each year.

The second dimension of our vision is our international strategy, where we are looking to learn from—and share our own—good practice and expertise with other public audit agencies around the world. You will see from our international report that we have a good deal of interest from overseas audit agencies in what we do and the ways that we work, and we greatly value our global networks that allow us to learn from others and to compare our performance but also to share our good practice. Those are the two primary indicators of our being a world-class audit organisation.

We then report our impact in a number of ways, through our annual report and accounts and also through impact reports on pieces of audit work, which are in the public domain once they are published.

I know that this has been discussed for some time, but, after five years, are you now a world-class organisation?

It is probably not a thing that you ever achieve. We continue to improve, and standards around the world continue to improve. We all know the challenge that the audit profession in general has faced over the past couple of years. The important thing is our commitment to continue to achieve and exceed those international auditing standards—the ISA and the INTOSAI standards—and to keep learning from our peers globally. I am not sure that we will ever be in a position where we can tick the box and say, “That’s done”, but we are confident that our performance is up there in a world-class context and that we continue to improve year on year.

If you have a vision, it might be useful to show some progress or achievement against that, rather than just stating it as a vision.

Clearly, this is the overall annual report and accounts. Our corporate plan and our corporate performance reporting, which go to the board quarterly, set out a range of performance measures, our progress against them and our next steps. Again, all of that is in the public domain from the board papers, which we publish on our website each time. I am very happy to talk you through that, if that would be useful, but we summarise our performance in the annual report and accounts.

It is just that that is mentioned on page 2 and seemed to be important.

The question that I was going to ask is a simpler one. Page 66 sets out the value of your intangible assets. We were talking about a digital auditor, which I thought might be some sort of robot with artificial intelligence, but perhaps not. You have retired or disposed of £344,000-worth of intangible assets and added in £51,000-worth of intangible assets. How does that tie in with what we were speaking about in terms of spending more time on digital work?

The intangible assets are software licenses, which we need for our work. I will ask Stuart Dennis to talk you through the detail, but, broadly, we are spending more on software and less on hardware to support our digital working, in line with the general move to operating through cloud computing rather than through software that is held and operated on our servers. Stuart, can you talk Mr Bowman through the—

I was just going to say that it seemed that you had taken out a big number and not added very much in.

Stuart can talk you through the detail.

On the disposals for the year, we moved on to a new fixed asset system. We had a tidying-up exercise, in which we wrote off old licences that, in most cases, had fully depreciated. The main addition for the year was an upgrade to the human resources system. It was really a tidying-up exercise of the gross book values and the depreciation that had been accumulated.

You were tidying up old stuff that had depreciated and added an HR system. Where are the costs for the digital auditor and the additional time spent on digital working?

The digital auditor is an individual post. It is not a system, as things stand. We are developing our own system in-house, so that would not be an additional increase in intangible assets.

It is something that you are developing yourselves. Is that correct?

Yes, that is correct.

The report shows a gender pay gap in that, on average, male staff earn 12.79 per cent more than female staff, even though three quarters of the senior management team are women and more than half of the organisation-wide leadership group are women. Given that women hold the majority of senior positions across Audit Scotland, what are the explanations for the reported gender pay gap?

Mr Sarwar, that figure demonstrates the limitations of any single metric that aims to capture something complex, such as gender equality and gender discrimination. We pay serious attention to this, as do our board and our remuneration committee. Over the past couple of years, our efforts to ensure that the key group of staff that we recruit as professional trainees is as balanced and diverse as possible have really made the difference. We have seen an increase in the proportion of our trainees who are female. They are people who will progress through the organisation, as they qualify and move into more senior roles. However, as they come in on our training grade, they have the effect of bringing that pay ratio down rather than up.

As you say, on representation and pay equality, our performance is good for the management team and the leadership group. However, the overall metric is affected by our success in bringing in female trainees, who will progress through the organisation in the years ahead, but who, now, are bringing the gender pay gap ratio below where we would like it to be.

That is good to hear. What about the equality gap more generally? Is there any analysis of ethnicity, race or any other protected characteristics? There is a lot of information on gender, but nothing on anything else.

The gender pay gap is what we are required to report. As you will know, we take diversity in all its facets very seriously, and we have an equality and diversity working group in the organisation, which looks at our performance both as an employer and in our audit work and how we take that forward. I will ask Diane McGiffen to give you a bit more information about how we monitor our performance as an employer, but one of the challenges is that our monitoring relies on people declaring their ethnicity, some other protected characteristics and whether they consider themselves to have a disability, and we do not have 100 per cent reporting on that. Diane, could you give Mr Sarwar a bit more information about the way that we monitor and manage those important aspects of our performance as an employer?

Thank you. We monitor all recruitment activity, and we monitor and report on the progress of recruitment, selection, appointment, training and progression for all protected characteristics in our diversity monitoring reports. We are required to publish that data every two years, but we produce it every year, and the board and the management team will shortly be considering that. I will amplify the Auditor General’s earlier points on the gender pay gap to give you an example: as at 31 March 2019, 73 per cent of our lower quartile employees, which is where our graduate entrants come in, were women, and that has reduced the median rate of pay. We are shortly to publish our figures for 2020, and those will show a reduction in the pay gap as people have progressed through the scheme, and we will send you a copy of that report when it is available.

Almost 7 per cent of Audit Scotland’s workforce is from black, Asian or minority ethnic groups. Among trainee auditors, that is about 13.5 per cent. Last year, about 13.8 per cent of applicants for all our roles were from black, Asian or minority ethnic communities, which was down slightly from 14.5 per cent the previous year. However, 8.1 per cent of our appointments were to black, Asian or minority ethnic colleagues, which was up from only 3.3 per cent the year before. Our graduate training scheme is the key entry route to the organisation. We have stressed that many times for you. It is essential for us to keep recruiting, training and providing a good experience for our trainees, most of whom we want to keep in Audit Scotland and in the public sector, where we can.

We currently have 43 trainees, and we work hard to reach out to recruit graduates. We hold open evenings, we attend many recruitment fairs, and we also reach out to schools and other organisations to encourage people to think of auditing as a career, if that is not an obvious route for them. We have four school leavers in the ICAS training scheme, which is going well for us, and we also have two modern apprentices. We monitor all our HR performances and statistics and report on them, and we work hard to live up to our aspiration to be a great and diverse employer.

That is excellent. I appreciate everything in that answer, and I would expect nothing less from Audit Scotland than for it to be an exemplar for organisations across Scotland.

I have a follow-up question. When you evaluate all the organisations that you audit each year, you consider gender disparity. Why do we not look at race disparity as well, as a practice?

I am not sure that that is a question for us, Mr Sarwar, as opposed to Government. As part of the best-value duty that is placed on councils, they are required to live up to and demonstrate diversity and equality. Therefore, the auditors are required to look at the way in which each council is doing that, make a judgment on how effective it is and share good practice for others to learn from. It is not something that we have done direct work on in the central Government and health parts of our responsibilities, because of the differences in the Government’s regimes. However, in the annual reports and accounts, we ensure that all public bodies are reporting the information that they are required to and that that information is checked back with the underlying systems to ensure that it can be relied upon, that it is robust and fair. Therefore, we do some work there, but one of the continuing conversations we have through our equality and human rights advisory group and with the Equality and Human Rights Commission is about how we can ensure that our respective responsibilities and roles complement each other rather than adding burdens that do not lead to real change but that provide an extra overhead for the bodies concerned. I am sure that that is a conversation that we would be happy to continue with you as the work evolves in the months ahead.

Thank you. Would you need Government permission to do a race disparity audit across Scotland’s public sector?

We would not need permission, but, as always, there is a question of where we are making best use of the resources available to us through the Scottish Commission for Public Audit and through the audit fees that we charge and how we ensure that our work complements rather than overlaps the work of other organisations, such as the EHRC in Scotland and the statutory responsibilities that bodies have. That is not to rule such work out, but it has never felt like the area where we could add most value. However, it is a continuing conversation, and you are quite right to highlight it.

I look forward to having that conversation with you, Auditor General, and with your successor in due course.

On complaints, according to the report, four complaints were recorded over the year, but only two were investigated, and those were not upheld. Can you clarify why only two of the four complaints were investigated?

Yes. I suspect that Diane McGiffen may want to add to this. One complaint was assessed as being outside our complaints handling procedure, and the complainant was redirected to the Scottish Public Services Ombudsman as the appropriate person. After additional correspondence with us, we were able to provide some more information, but the complaint was outside our procedure. One complaint is on-going at this stage, and we cannot give more information than that. The other two complaints were not upheld, but, in one case, we found that we could have communicated in a more timely manner. We aim to learn from complaints in each case.

For clarification, of the four complaints, one was outwith your scope and was referred, one is being investigated but is not concluded, and two were investigated and concluded.

That is right.

Thank you. I hand back to the chair.

There are several budget lines on page 63, but the one that stands out is expenditure on communications—telephone and postage. You exceeded that budget by 66 per cent. It is not a huge sum in itself, but, for something that is as limited as telephone and postage, that seems to be a high percentage. What are the reasons for that, and is it an on-going situation?

I will ask Stuart Dennis to give you more detail, but, looking at the budget lines, you will see that there was a significant reduction from £82,000 in 2019 to £63,000 in 2020. Stuart, please could you answer the chair’s question about the spend against budget in 2020?

Yes. As the Auditor General said, the figure has come down from last year. The main reason for that is our mobile telephone contract. The old one was concluded in August last year, and we negotiated a new one for a much better cost. Therefore, there was still an overspend last year, but that should flatten out this year and we should be on budget.

So that is a bit of a blip.

Last year, you did a record number of section 22 and section 102 reports. Does the increasing requirement to produce those reports, which, presumably, are somewhat more complex and require more digging than your normal reports, represent significant additional work for the auditors? How are you managing the pressures that might arise from that?

You are right to highlight them, chair. Section 22 reports are the vehicle that I have, as Auditor General, to draw to the attention of Parliament and the Public Audit and Post-legislative Scrutiny Committee issues that have arisen from the audit of individual bodies. Section 102 reports are the equivalent in local government, where the controller of audit reports to the Accounts Commission. By their nature, those reports are significant and generally about things that have gone wrong in a public body. However, occasionally, they will be an update on a matter of significant public interest, such as the section 102 report on Glasgow City Council’s settlement of its equal pay claims. They require significant additional time and expertise from auditors to conclude.

The increasing number—it went up in 2018-19 as well as in 2019-20—reflects the pressures on audited bodies, which I referred to in my opening statement. We keep a small budget available for exactly that type of work, which we can use to pay firms or to make additional resources available to the in-house teams to do the necessary work and to support me in presenting a section 22 report to the Public Audit and Post-legislative Scrutiny Committee. However, where the volume of work exceeds the amount for which we have budgeted, we have to accommodate it by flexing the programme overall—by delaying some pieces of work or reducing them in scope. Therefore, those reports are a significant part of our work, which we must actively manage year on year. We have flagged the increasing number, because it is a trend that we are watching closely.

Within the trend of the increasing number, are there common themes in those reports? What I am groping for is the impact of the complexity in the reports. For example, we know that IT comes up a lot. Does that area engage more resources from Audit Scotland than other areas? I am just groping a bit to understand.

You are right to ask whether there are common themes. IT services have been a common theme in my areas of responsibility, as you have seen on the Public Audit and Post-legislative Scrutiny Committee, and require extra resource. I would not say that it is necessarily more again than, for example, is required in the work that we have done on NHS Tayside over the past few years. Both require senior staff and expert staff. They are expert in different ways, but I do not think that more expertise is necessarily required for IT systems than is required for the sort of complex governance problems that we have seen in NHS Tayside.

I think that I am right in saying that procurement has been a common theme in the Accounts Commission’s area of responsibility. With Police Scotland, the Accounts Commission and Audit Scotland have produced some guidance called “Red flags Procurement”, which is for audited bodies, setting out some of the warning signs that they might look at and for when they are concerned about good practice in procurement.

We look for those common themes because, ideally, we would like to be able to get in upstream and prevent problems from occurring. Equally, we want to learn from them in looking at the risk assessment that we carry out for individual bodies in future.

Thank you. On page 23 of the report, you say:

“the Covid-19 situation has increased the risk in this area as some people/organisations are seeking to exploit the situation.”

Is that a warning shot about problems that will be coming down the line? Have there been breaches of IT security that will require more resources?

As an organisation, and as auditors of 200-plus organisations around Scotland, we are certainly seeing increased cybersecurity risks, with the overnight move to remote working that we all had to undertake in mid-March.

Within Audit Scotland, we have seen an increase in the number of phishing emails that we receive. We have seen some increase in sophistication, with those being targeted at particular people, particularly senior people in the organisation. We have seen general pressures on our IT systems and the security of our data. So far, we have been able to manage all of that, but it has put a lot of pressure on our digital services team, and our auditors are seeing the same sort of pattern in the bodies that they audit. At this stage, I cannot give you any indication of the impact, other than to point to the pressure that is being put on the people who are responsible for digital security, but it is an audit risk that we are looking at closely and managing in our organisation.

On page 63, point 4 of annex B sets out other operating expenditure. Under fees and expenses to appointed audit firms, there has been a substantial increase in payments to firms for audits of further education colleges. Is there a reason for that?

Stuart Dennis will keep me straight and may want to add something. We have seen increased fees being agreed between auditors and some colleges, reflecting some of the challenges that they face. I have reported those challenges to the Public Audit and Post-legislative Scrutiny Committee in the annual report on colleges as well as in a disproportionate number of section 22 reports on individual colleges in the sector. That reflects the fact that colleges have relatively small governing bodies; it also reflects the financial pressures that colleges face, and it is a result of the nationalisation of terms and conditions as well as the changes to the curriculum across the country. Therefore, there is a good reason for the increase, which reflects the risks with which the bodies operate.

Is it likely to be a trend?

I do not think that it is likely to continue to increase, but we have seen it increase as we have carried out the annual risk assessment and gone through the discussion of audit fees between auditors and colleges.

On page 64, on operating income, fees and charges payable in the national health service seem to have dropped.

Yes, those have reduced very slightly. Again, to a large extent, that comes from the annual assessment of risk, but I ask Stuart Dennis whether there is anything extra that he would like to say about NHS bodies or FE colleges.

On FE bodies, the Auditor General is correct that there is a pattern of additional fees needing to be negotiated and charged. Those have been agreed with the audited body and are due to the additional work required. That has been a pattern for the year, but I would not expect it to go up in the same way next year. However, we never know what is going to happen.

In respect of the operating income, the slight decrease is purely due to our being slightly behind where we were last year in respect of health bodies. We are required to recognise the amount of income from the work that we have done when starting the new audit. When we started the 2019-20 audit, we were slightly behind, and some of that could be down to Covid-19 and access to health bodies in March. That is the reason for the slight decrease in the operating income.

Before I close this part of the meeting, I wish to reflect again on the fact that Caroline Gardner is stepping down in early July. Caroline, perhaps this is a good time to ask you to reflect on your experience a little over the past eight years and what messages you might have for the commission. What could we be doing better to provide support?

Thank you for that invitation, chair. It is very welcome. First, it is important to say that the SCPA plays an important role in ensuring the independence and sustainability of public audit in Scotland. Having this very direct reporting line to Parliament for the Auditor General and the organisation is a key part of ensuring that we can provide the independence and quality of public audit that Parliament requires to carry out its work well. I know that it is only a small part of your work as MSPs and that it is perhaps not the reason why you came into politics, so I am grateful for the commitment that you all demonstrate to fulfilling that role.

As you know, the Audit Scotland board is responsible for overseeing the governance of the organisation and for ensuring that we live up to the standards that we expect of others, which is something that we take very seriously. The SCPA’s role is a different one: you are responsible for appointing the board’s chair and independent members. It is extremely helpful to have your engagement with the strategic issues that we face, to ensure that we are considering those properly and planning for them well.

A good example of that has been our response to Scotland’s new financial powers over the past four years. Those powers represent a significant change in what the Government must do and has the opportunity to do. There are big questions for us as auditors about how we can develop our capacity, skills and expertise to respond and to add value as Parliament scrutinises some quite different decisions about revenue raising and long-term financial strategies, rather than about how the budget should be spent from one year to another.

We have been very grateful for your encouragement and support as we built the capacity to allow us to underpin Parliament’s work in those areas. It is one of the achievements of which I am most proud in my time as Auditor General. I think that the commission has done a great job in engaging with us to understand the issues and then encouraging that work as we have developed it.

These formal meetings are a central part of your work, and they allow us to demonstrate publicly our accountability to the Parliament. It is important that that continues. The less formal business planning sessions have also been useful in helping us to set the formal meetings in context, to answer any questions that you and other commission members may have about our work, and to help to develop that insight behind the scenes into what we are grappling with, what we think is working well and what we are finding more difficult to get right. That direct connection to the Parliament is an important part of public audit in Scotland.

I have been grateful to the commission for your challenge and support over the past eight years, and I know that my successor, Stephen Boyle, will be keen to engage with you and your clerks to consider how we can continue to make this working relationship productive, as well as to demonstrate that all-important accountability and good governance.

Caroline, I am sure that I speak on behalf of all commission members in wishing you very well in your future endeavours, as you go on to ever greater things from here. I am sure that we will meet again.

I will suspend the meeting briefly to allow for a change of witnesses.

Welcome back. From Alexander Sloan, I welcome Steven Cunningham, partner, and Jillian So, audit manager. Before we move to questions, I remind everybody that, because of the challenges of managing a virtual meeting, we will take questions in a pre-arranged order. If any member has a supplementary question, they should please type “R” in the chat box, and I will bring them in as soon I can. If any member does not wish to ask a question, they should indicate that in the chat box. As always, I ask members to keep their questions and answers as succinct as possible, and to give broadcasting staff a few seconds to operate the microphones before beginning to speak.

Would either of the witnesses like to make opening remarks before we ask questions?

Good afternoon, chair and commission members. I confirm that we received all the necessary information and explanations to allow us to undertake our audit of Audit Scotland for the year ending 31 March 2020. There was no limitation on the scope of our audit work.

I will give a brief overview of our work. Alexander Sloan was appointed by the Scottish Commission for Public Audit to carry out the external audit of Audit Scotland’s 2020 financial statements. I am the partner on the audit and the responsible individual. During the year, we attended all Audit Scotland audit committee meetings. Our interim audit was conducted in February at the offices of Audit Scotland. The final audit was carried out remotely, due to the closure of Audit Scotland’s offices because of Covid-19. I assure the commission that working remotely did not have an impact on our gaining sufficient audit evidence, and the audit was completed without any significant problems.

As part of our work, we reviewed all internal audit reports during the year and held discussions with Audit Scotland’s internal auditors. The audit file was also subject to a second partner review in accordance with our quality control procedures. That review was carried out by our senior partner, prior to the signing of the audit report. The audit was carried out in accordance with international standards on auditing, and, as I said, we received all the information and explanations that were required to form our audit opinion.

Based on our audit work, we form an opinion on whether the accounts give a true and fair view and on whether they have been prepared in accordance with international financial reporting standards, as interpreted and adapted by the financial reporting manual. We also confirm that they have been prepared properly in accordance with the Public Finance and Accountability (Scotland) Act 2000 and directions by the Scottish ministers.

We were satisfied on all three points and therefore we have issued an unmodified audit report. In other words, we are satisfied that the accounts give a true and fair view and are in accordance with legislation and accounting standards. The accounts and the audit report were signed on Tuesday 9 June. We are also required to prepare a management letter, based on our findings, the purposes of which are to summarise the key audit issues arising from our work and to report any weaknesses in the accounting systems and internal controls. I am pleased to report that we did not find any weaknesses in the accounting and internal controls.

Finally, I would like to record my thanks to Audit Scotland and the support staff of the SCPA for their assistance during the audit. Thank you.

Thanks. You have comprehensively answered the first question that I was going to ask, so I will move on to Anas Sarwar.

Thank you, chair. In its accounts, Audit Scotland has included income that it will receive from work in progress, based on a judgment of work completed but not yet charged to audited bodies. Are you satisfied that that calculation is accurate and robust?

Yes, we are. We spent a significant proportion of the audit looking at that. We look at the methodology, the time records and the accounting policies, and, from that work, we are satisfied.

Thank you. That is the only question that I had, chair.

I am glad that you mentioned the internal audit review because, on page 29 of the annual report, Audit Scotland states:

“BDO’s 2019 review of our risk management arrangements provided positive assurance and we achieved the highest risk maturity assessment available.”

BDO is the external audit firm that carried out the internal audit. What is a “risk maturity assessment”?

The internal auditors look at risk systems with Audit Scotland and, based on that work, they make a judgment on how mature Audit Scotland’s procedures are. We are not directly involved with internal audit, but we look over those reports to see whether there are any issues that may cause concern for our external audit.

Perhaps I should have asked that in the previous evidence session. It sounds like a good thing.

With regard to being a going concern, Audit Scotland is funded by the public sector, either from the Scottish Government or from the local authorities that pay audit fees. There is probably no long-term uncertainty about that. However, in the short term, everybody is under pressure to minimise cash-flow outgoings or they are short of cash. Do you look at what immediate liquid resources are available to Audit Scotland? If some of its receivables were a bit delayed, would it have enough cash or resources to borrow to keep making its monthly payments?

We have discussions about that with Audit Scotland every year, but particularly this year, given the added complications that have been caused by Covid. We look at budgets and we discuss its fees. Naturally, there will be some delays, because of the nature of organisations and cash flow and problems due to Covid-19. We look at all that and take it into account when we have our going concern discussion. Based on that, we are happy that it is still a going concern and that it has cash flow. Audit Scotland may come back to Parliament on its budget. Certainly, some audits may be delayed and there has been an extension of audit timetables as a result. However, we had discussions and looked at the information available, and we were happy with that.

If it had an issue, would it have to come to the Scottish Government and take money from a bank account? Do you know where liquid resources would come from in a moment of difficulty?

I think that Stuart Dennis would be the person to give you more detail on that.

On the financial statements, we particularly rely on your expertise where there are specialists involved and technical accounting requirements, such as around the pension costs and liabilities. Are you satisfied with all the disclosures relating to the pension costs and liabilities in the current financial statements?

Yes, we are. We spent a lot of time looking at that. We also considered the reasonableness of the assumptions used, and we were satisfied.

I think that those are all the questions that we have for Alexander Sloan. Thank you for your attendance. That completes everything and concludes our evidence session. I thank all our witnesses. The commission is particularly appreciative of the work that has been done to produce the accounts on time, given the challenges of remote working.

That concludes the public part of today’s meeting. I will allow a couple of minutes for a comfort break, before we resume in private session.