 I welcome everybody to this, the 23rd meeting of the Public Audit Committee in 2022. The first item on our agenda is for members of the committee to agree to take agenda items 4 and 5 in private. Are we all agreed? We are agreed, thank you very much. We've got two items of public evidence gathering this morning on our agenda. The first of those is to look at the National Fraud Initiative in Scotland 2022 report, which has been prepared by Audit Scotland. Our two witnesses this morning that I'm very pleased to welcome in the committee room are Anthony Clark, executive director of performance audit and best value. This morning Anthony is joined by Ann Cairns, who is the manager of performance audit and best value at Audit Scotland. We've got some questions to put, but before we get to those, Anthony, could I ask you to make a short opening statement? Thank you. Good morning, convener, and good morning, committee members. I'm delighted to be with you today this morning to brief you on Audit Scotland's report on the National Fraud Initiative in Scotland 2022, which we published on 18 August earlier this year. As the committee members probably know, the NFI is a counter fraud exercise across the UK public sector, which uses data matching to help prevent and detect fraud. It looks for fraud and error related to things like blue badges, public sector pensions and council tax discounts, and it's an exercise that takes place every two years. 132 public sector bodies in Scotland participated in the NFI exercise in 2020-21. That's an increase of eight since the previous exercise two years ago. Alongside the report that we have in front of us today, Audit Scotland also published some more detailed analysis of the findings on different organisations and different sectors and different localities so that the public can get a picture of what's happening in their area. We think that communication with the findings of this exercise is really important as part of the deterrent effect of the NFI. I'll briefly, if I may, highlight some of the key messages in the report. Outcomes valued at £14.9 million were identified in this exercise. The cumulative outcomes from the NFI since it started in 2006-2007 are £158.5 million in Scotland, with a cumulative total across the whole of the UK of £2.4 billion. There's been a fall of £400,000 in the amount of outcomes recorded in Scotland since our last report, so that's a small fall this year compared to the exercise two years ago. We can't say exactly what this is down to, but we think there are a number of reasons why this might have happened. Partly to do with, we think, less fraud and error in the system. People are learning lessons from previous exercises, improving their controls. We think there are stronger internal controls in place in a number of public bodies. It's also quite likely that the fall may be caused partly by the fact that data matching to do with payroll and pensions is now being done separately by the DWP with local authorities on a real-time basis. That's one of the areas where we used to identify housing benefit fraud, so it's being picked up elsewhere. A key benefit of participating in the UK-wide exercise is that data can be shared between bodies across national borders. Data submitted by Scottish bodies in this exercise helped other organisations in Scotland and across the UK to identify outcomes of £1.2 million. I'm pleased to say that most organisations demonstrate a strong commitment to counter fraud in the NFI, but a lower percentage of participating bodies managed their role in this year's exercise as well as we would have liked. There's been a slight deterioration in the quality of participation among public bodies. External auditors have identified areas for public bodies to improve their participation in the future, and that's something they'll be following up with, with the bodies concerned. As you know, we've discussed this on a number of occasions with your predecessor committee, Papples. Audit Scotland is always keen to develop the NFI, and we've undertaken a number of pilot exercises, which we've been looking at new ways of data matching to see whether they are all proof to be fruitful in identifying fraud. We've set those out in the report in pages 20 to 23, and I suspect that we may want to talk to you a bit more about the pilot exercises and what they've found. Finally, Audit Scotland continues to work with the Cabinet Office and the Scottish Government to develop new ways to prevent and detect fraud, and we set out how we do in that in page 24 of the report. Convener, as always, and then I am very happy to answer any question from committee members. Right, Anthony. Thank you very much indeed, and I've got a couple of questions to get us under way. The first thing I have to say that struck me was the cases identified, and I think it's led to four prosecutions by the police. The cases identified are largely small-scale household-level examples of fraud or individual fraud. Is part of this exercise designed at all to look at wider spread, organised crime fraud or examples of much bigger co-ordinated attempts to defraud the system? I think that it's important to recognise that the process that we have through the NFI is really designed to look at many of the large-scale systems and processes that are in place within public bodies and to identify whether or not there are systemic problems that can be addressed. So to that extent, I think, if we did see systemic problems and they could be linked to serious normalised crime, we would obviously follow that up, but it's not the purpose of this exercise, Mr Leonard. We have a range of other arrangements in place to look at the quality of counter-fraud arrangements within public bodies through internal audit, external audit, and also many public bodies have their own counter-fraud teams as well. We in Audit Scotland gaze very closely with Police Scotland around this work as well as the Cabinet Office, but that isn't the purpose of this exercise primarily, Mr Leonard. OK, that's a helpful clarification, thanks for that. You've identified that the amount identified in this exercise was slightly down on the figure identified in 2020, which would have been the last time the exercise was undertaken. Do you see that as a sign of success, that there's a growing public awareness, or do you see that as a sign of failure that more fraud has gone undetected? It's a brilliant question. I'm always slightly cautious about answering this question because it's cropped up in a number of times when police has been in front of the papals. I think we feel that it probably is a sign of success in many ways, that people are learning the lessons that were identified in previous NFI exercises. I'll bring Annan in a short while once I've given my initial answer, but we do know from our liaison with auditors, the Cabinet Office and with participating bodies that people are learning the lessons and sharing good practice. There's a whole network of agencies and arrangements that sit alongside the NFI and wider counter-fraud activity, which are used to share good practice. What we do see in this NFI report is an example of people learning lessons strengthening controls. I wouldn't want to be complacent because it's a bit of a known unknown. I don't think that anybody could sit here with confidence and say to you whether or not fraud is increasing or decreasing across the public sector. It's a very volatile and changing environment. The reason why we had some of these pilot exercises this year is because new funding streams come into play, new systems get introduced. It would be very difficult to say that fraud in year X is X per cent, fraud in year Y is Y per cent and what balances, if you understand my drift. Do you want to add anything to that? I think that we really shouldn't be complacent over the last couple of years. We've actually issued a report to the audited bodies on our website for the general public about new emerging risks that we identified as coming into play during the Covid pandemic. That's one additional challenge that the public sector has had to deal with. I think that the outcomes have gone down because the local auditors, the external auditors and the audited bodies have identified previous control weaknesses through previous outcomes identified in the previous NFI exercise and they have followed that up with the bodies to ensure that they have strengthened their controls. That's obviously a positive. On our negative side, we are seeing the public bodies having been struggling over the past couple of years just due to Covid resource pressures, sickness absence, et cetera. Having said that, the majority of them have participated in the NFI. They have dealt and reviewed their high-risk matches, the ones that we would really expect them to do and they have got there, not as maybe as timuously as in the previous exercise, but they have got there. In the current exercise, we also had, you'll see through reports, a few data sets that were not included in this time round. For example, the immigration data wasn't included due to restrictions placed on it by the home office. Obviously, the housing benefit data has now been matched through DWP systems, which was another source of significant outcomes in previous exercises. We have had some challenges around the legalities of patient data that we are still working our way through. Again, those matches haven't been included. Those are the areas that we would have expected outcomes had it been on a light-for-light basis to previous exercises. It's a bit of a mixed-picture, really. There are some positives, but there are also some negatives. Thank you. Some of those areas that you have identified and I think that members of the committee will be asking further detailed questions about. You mentioned your opening statement, which was something that the report alluded to, which was that this time there appeared to be a greater reliance on external agents, which I presume is a euphemism for outsourcing of some of the data-matching work. My first question is, do you have any reflections on whether that affected the quality of the data-matching exercises? Secondly, was there any pattern there? In other words, for example, was it smaller local authorities that were maybe struggling more through Covid and its effects that were having to rely on outsourcing some of that work? Or was it big local authorities, for example, or big public agencies, for example, as well, that were doing that? If I might just answer the first question around the data quality, then I'll hand over to Anne to talk about the nature of the agents and where they were used. I think that we're very satisfied that the quality of the data that was submitted and the quality of the data that we reported in this exercise is as good as previous NFI exercises. We wouldn't have published the report had that not been the case. There are very strong and robust quality assurance arrangements across all of the UK Audit Agencies, Cabinet Office and others to make sure that that's the case. Anne may want to say a little bit more about the specifics of where agents were used and why that was the case, if that's okay. Yeah, that's fine. Thanks, Anthony. Yeah, we had a few councils who decided to use external contractors in respect to their council tax single person discount matches. There was a few reasons for that. Some of them, the timing of the NFI, didn't suit them because, as you appreciate, it's a once every two year exercise so they could do it when they wanted, as they wanted. Some of them had other contracts with the external provider doing data matching in different areas and therefore it was built on to an existing arrangement. It wasn't prevalent over whether it was larger authorities or smaller authorities that tended to be medium sized authorities. Although I have had discussions with one authority who was considering and had previously used an external contractor for some of this work last week and decided that they would just use the NFI going forward, I should also point out that the NFI is only one of the many tools in the councils counter fraud tool kit. So, as long as they're actually doing the work, we're generally content that they're addressing the sort of fraud issue so we don't sort of be too harsh on them. There are a few who have gone down that route. Okay, thanks. We've got some more questions in this area and I'm going to bring in Colin Beattie, first of all, who wants to follow this line of questioning up. Colin. Thank you, convener. Good morning. I suppose it's pretty mixed for this particular NFI out turn. It's good to see there's eight additional participants and the spread of participants, a number of participants, has been part of an ongoing discussion between this committee and the Auditor General over an extended period and that's still unresolved. But there are some key points that I would like to bring up. In page four of your report, it says that immigration data was not included in 2018-19 and 2021 exercises due to restrictions placed by the Home Office. Can you tell me a little bit more about the restrictions that the Home Office has put in place that results in immigration data not being included? I'll give a brief overview and then hand over to Ann. She may want to add a bit more detail. This situation arose as a consequence of the Home Office's review into the Windrush generation issues and it was as a consequence of that review exercise that the lawyers in the Home Office determined that it wouldn't be appropriate for immigration data to be shared with us as part of the NFI exercise and, indeed, other agencies that are participating as well. Is there a bit more detail that we can add on that, Ann? That was our main reason initially why the Home Office gave for not sharing the data. They wanted to review their own data before they started sharing it with other bodies. More recently, they have been looking at alternative ways of sharing data with public sector bodies, for example, through the Digital Economy Act, as a wider project. At present, the Cabinet Office is still in discussions with the Home Office about trying to get more or get immigration data back into the NFI, but, as yet, that has not been successful. For the next exercise, we do not know whether the data will be there either. We don't, but I think that we would hope that it would be resolved in the forthcoming period, two years before the next exercise, the moment that it would be resolved by then, Mr Beattie. What was the impact of that? What was the impact of not having that data? Do you want to have a go at this? The immigration data was really helpful in relation to student award data in that we were identifying students who were here getting funding from the student award agency in Scotland and that were not entitled to it because their immigration had expired or whatever. We were also finding some of the payroll data. Typically, it was NHS bodies that were finding that they had employees who their immigration status had changed and they were not aware. It was really roundabout, the sort of payroll and student award matches that were impacted this time. I think that we are all conscious that there have been quite a few different requirements placed on employees, both public and private sector employees, around identifying and being confident that the immigration status of staff and employees are as they should be. That is just another adjunct to the NFI work as well. I would have thought if they were giving the excuse that this is about Windrush. Windrush is a fairly discreet number of people. Is it really impacting that much on the big picture? I do not think that we can really... Is that what they are actually saying that it impacts on a right number of people? Our understanding is that the legal advice or the legal considerations within the Home Office is that they felt that it would not be appropriate for this NFI exercise to share immigration data because of some of the broader issues that were identified through the way in which some of the people that arrived in England as part of the Windrush generation had been treated. It is part of a wider set of considerations that have had an impact on the NFI rather than being a specific NFI issue. Okay. On page 4 of the report, there is also a question about residential care home data. Direct payments and social care customers' data were not matched in the 2021 exercise due to a legal question being raised about the definition of patient data. Can you tell us a bit more about that legal issue? Has it been resolved? Will it be resolved soon? I can give you a bit of a sense of what the legal issue is. I might ask Anne to either add a bit more colour and then confirm whether or not this has been resolved. This issue arose because there has been a difference of opinion about the extent to which social care data should be treated as patient data. The legal advice that there is within... Is it the Home Office? The Cabinet Office. The Cabinet Office, sorry, is that they believe that some aspects of social care data should be treated as patient data. Therefore, for that reason, it was not possible to include some social care data as part of this NFI exercise. That issue is seeking to be resolved. I am not entirely sure whether it has been resolved yet but I don't think it has, has it? No. The real issue is that, in the legislation, the lawyers in the Cabinet Office started to look at this area of the NFI and started to question whether the data that the councils are submitting could be classed as patient data. We are typically talking about people that get care in home or in the sort of nursing homes and they came to the view that that could be classed as patient data. In the legislation, the definition of patient data can be read several ways and you could say that that was patient data. In the legislation for the data matching exercises that we are permitted to carry out and indeed what the Cabinet Office has carried out, it actually says that if we take patient data from an NHS body, the matches as a result of the data matching have to be released to the NHS body. Obviously, a council is not an NHS body so we could take the data from the councils and do the matching but we would not be able to release the matches back to the council. I have been working with the Cabinet Office legal team to try and resolve this issue and the English Local Audit and Accountability Act we think that there might be a way of amending that piece of legislation. Jacob Rees-Mogg has been involved and he was up until fairly recently until he changed position. He was quite supportive of thinking that we might be able to get a change to that that would allow us to take the data from the councils, do the matching and release the matches back to the councils. The Cabinet Office lawyers still have not signed that off and they are still considering it but that is where we are at and we are actively trying to get this in as soon as possible. Is there a way around this to have a personal care partnership within the council? I do not think that that would be possible under the legislation Mr Beattie. The same issue would arise. It has to go back to our health board. So the obvious question is what has the impact been? It means that we have not been able to do those data matches and identify whether any outcomes would arise as a consequence of the data matching. In the past have you had discrepancies? There are people who are in care homes, nursing homes, who have unfortunately passed away. The care home hasn't notified or the council hasn't been notified and the council has continued to pay the monthly bill to the care home until the match was identified and the payment was stopped. Potentially it can be significant? Yes. Okay, just curring on this page four of the report has a lot of bad news on it. That's how we can be one of the good news soon then. It says that in connection with the deletion of data for 11 councils inadvertently deleted so full documentation is not available for these councils. The cabinet office has taken steps to prevent this error from reoccurring, hopefully. So what impact has that had? I mean this obviously affects council tax discounts, doesn't it? So what's the impact especially for those 11 councils concerned? I am going to hand this one over to Anne because she was much more involved in this. Specific to this than I was, if you forgive me. Thanks, Antony. Yes, this was a human error. That, you know, there's nothing to do with the IT or anything else that was human error and what happened was due to the data protection act at the end of each exercise as you would imagine the data is no longer deleted. When the head of the NFI was signing off the data deletion instruction to the IT contractor instead of saying the previous exercise the data was to be deleted up until November it actually an error said December and he didn't pick that up the person who second checked it didn't pick that up it was signed off and of course the IT contractors just do what's in the instruction and it was unfortunately deleted The impact for those Am I correct in saying that there's one month data deleted? Well it's not as simple as that because in that month that was the month that those councils uploaded their data so it's not just one month of the matches so those matches stayed in the system for about a year the councils were able to work on them but it did disappear so it did mean the councils were able to work on the matches because it wasn't deleted immediately but we don't have the detail you know for example when you look at the report on the system for the council tax matches and the outcomes you could see council tax and Cairns there's the match here's the outcome this is our address that's our council tax that's why we've recorded an outcome say £500 and that's the dates and that's the reason why that has all gone what is there is just a summary management information summary report for each of those 11 councils we have said to the councils obviously involves does this look realistic does that feel like the rights that are value to try and verify that the figure in the summary report was right obviously they don't have the full detail and the full information behind some of the councils some records behind that if we're working offline on a certain number of cases that have been able to verify some of it but overall we don't have evidence to say that's the figure of the outcomes and that's made up of all these cases and these values we have obviously raised that with the cabinet office and they have assured us that we've implemented new controls and new arrangements around data deletion How confident are you about these new controls I mean the fact is it was a human error an instruction was given an instruction was checked and then released to the contractor who acted on it but why wouldn't that happen again I mean what they're going to do now have triple checks, quadruple checks they have implemented some automation that in the system as well so that you know I don't really understand all that I'm not an IT expert but they have implemented some sort of automation so that if data is deleted or asked to be deleted and it's out with the sort of normal range so if it was due to be deleted up to the November it would say, wait a minute you were asking for December, are you sure type thing as well as the members of staff being involved are mortified We can then give you a category or I can show once of course Mr Beattie that these things won't happen again human error is part of life regrettably whereas confident as we can be that people have done as much as they can to avoid this happening again it's a very regrettable thing, we're all very disappointed So there's hope Yes Kate, thank you Willie Coffey wanted to come in on this Harry, Willie Thanks very much, you can be on that issue this particular type of issue that's come to the committee before about data and data loss and whether there's backup data that could have been retrieved to have prevented from destroying the backup data as well did they Again, I'm not an IT expert but I did ask that question because that was my immediate thing well can you not just wind back the clock to whatever date it was deleted and the IT contractor went away and looked at that when we identified this issue it was when we were drafting the report we're trying to verify the figures as you can imagine so we're talking this May this year and we were trying to verify the numbers and we were like where's that number coming from we were struggling, that's when we went to the cabinet office and we said we actually raised the issue with them they weren't aware of it and they said oh sorry that the data has been deleted and that was one of my first questions can you just turn the clock back and apparently they could do that but it would mean everything that had been input into the NFI system and it went back to the December everything that had been subsequently input would have gone, would have been deleted so we would have corrected one thing but we would have created issues in every other set of data that was in the system If I may convene to make a more general point for me this reinforces the value of people moving to more real time matching of data so we have a more preventative model of identifying risks as and when they present I think the NFI exercise is a really important exercise, we wouldn't do it we wouldn't bring the report to you if we didn't think it was an important part of the if you like fraud management and dealing with toolkit but I do think it says to me that the merits of people sharing data on a real time basis across different agencies is another important part of this work I also think this reinforces the importance of people identifying and putting in place improvement actions on the back of the work this is an example of something having gone wrong in this report and in the report that I referred to earlier our fraud and irregularity report that we share with all public bodies and auditors we identify problems I think this is an important bit of the learning that needs to go on all the time around fraud and corruption Now I'm going to bring in Deputy convener Sharon Dower who's got some questions to follow of inquiry Good morning Page 9 of the report provides outcomes on information in the blue badge outcomes There appears to have been a significant rise in the number of blue badge outcomes but your report showing an increase of 44% more matches identified compared to the last NFI exercise Are you aware of any reasons that may have led to this increase? Yes The honest answer to this question is no one entirely knows quite what the reason is but the feedback we've had from at least one local authority that has looked into this in a degree of detail is that it may be a consequence of the Covid-19 pandemic and the higher mortality rates that people saw during Covid-19 so that seems to be the kind of sense we've got as to what might be prompting that increase That's the answer to the question Is there any more to add to that? No, not really We've had anecdotal information from councils in general they were finding the Covid-19 pandemic adversely impacted unfortunately people who tended to be on disability benefits and obviously people who had blue badges were part of that and as I say people unfortunately passed away due to the pandemic people didn't know where to hand in the badges councils were shot etc when we did the data match councils were finding that there were still a number of badges out there in circulation for people who had died When we were pre-exercising two years time we'd be able to give us a sense of whether or not this was a one-off blip or whether there was a more systemic problem Had there been a more systemic problem beyond that councils would have been reporting that to us as part of the NFI exercise so I think that's our suspicion at the moment moving on to pensions there's clearly been a significant drop in the value of pension outcomes that have been identified by the NFI exercise which the report suggests is down to improved effectiveness so this is obviously very welcome use What further steps do you think could be taken to reduce the one and a half million of outcomes that were detected? Gosh that's a good question I am struggling to think of a single answer to that one Sharon to be perfectly honest The sense we've got from this exercise as you've just said is that the matches that were identified through the NFI which we shared with SPPA and the appropriate pension bodies themselves were ones that they were picking up through their own control risks and so on and so forth so it does feel as though the control environment around pensions is relatively robust and relatively strong so I'm not sure there's a single thing I could sit here and say to you we need to solve x or y that will reduce that that makes like a council of doom that we just have to accept it I'm not saying we should just accept that this is a level of fraud or errors within the pension system but I'm not I can't think of a single obvious thing to say I don't know if you've got any silver bullet here but what I would say these tend to be obviously these matches for people who have died unfortunately and the pension has remained in payment and I suppose that to make it any real headway improvement would be if somehow we were able to move to real-time reporting you know if the pension funds were able to get real-time information you know when someone had passed away I mean they are using sort of tell-as-ones and they are strengthening their controls and that has as you can see resulted in a significant drop in outcomes we actually looked quite close like these outcomes I was like oh my goodness what's going on here and they did review they got quite a number of matches and we looked at them and they had properly investigated and reviewed them and it was just they got the matches because of a time indifference so we were saying oh someone has died but the time they reviewed it and looked at it they'd already actioned it in the time period between the data getting submitted so I suppose that the only real way to improve I would suggest would be some kind of real-time information okay thank you thank you Sharon Craig Hoy has now got some questions to put to you Craig good morning Mr Clark I'd like to maybe just probe a little bit more about housing benefit council tax reduction and then ask just a couple of questions in relation to recovery and prosecution on housing benefit page 11 of the report I exercise identified 177 cases of housing benefit over payments which had a value of £1.2 million which is a significant drop over prior years the report explains that this reduction is mainly due to the use of the department of work in pensions to verify earnings and pensions alert system so can you tell us when the DWP system came into use here in Scotland and whether you have a degree of certainty that that is the reason for that underlying drop I think I can give you some assurance that we think that is the reason for the drop I can't give you the date at which the system was introduced but maybe I will be able to I can't remember exactly it was before the pandemic but it's been a sort of emerging system from the DWP the DWP implemented it's accuracy award initiative as it was called and that was before the pandemic but initially it was on a voluntary basis so councils were getting matches and it was down to their self whether they opted to review them or not the DWP have progressed the scheme and made it mandatory for all councils to participate and the matches actually come through on a daily basis to councils their risk scored so top the pile every morning will be the highest risk one for that day if that one isn't action today it may still be number one tomorrow or it may drop down if another one comes in of higher risk the councils receive funding from the DWP to action those matches and as for the actual outcomes the DWP haven't reported any outcomes or results from that as yet what the DWP report is the overall level of fraud and error in the benefit system so part of that report is not on housing benefit but it's not specific just down to the the VEP system the figures do speak for themselves in 1819 it was 1,238 cases and then obviously most recently 177 so it does seem to be the costal link but just looking at the sum of the overpayments the report states that the average individual value of housing benefit overpayments has risen from 2,300 pounds effectively in 1892 nearly 6,700 pounds in 2021 are you aware of any particular reasons for that quite significant jump I'm going to have to ask Anne to us and I'm very sorry that's fine thanks we don't have any specific information on why that is the case it could be done to manufacturers you know it could be the rent levels have gone up or it could be the ones that they were identifying so they were running for quite a significant period of time the matching that was taking place in the NFI wasn't against the payroll so usually when you match against payroll you find it worse or regular quicker some of these are being matched against our right to buy cases in England or other housing records in another council so I don't know the particular reason because it has been going on for a longer period in time than in the previous exercise when it was just people's fluctuating earnings ok so there's probably work in progress in relation to that to try and identify what that is and given you that as a question Mr Hoy it's something we'll look at when we do the next exercise I'm just turning to the council tax reduction on page 13 of the report states that councils identified 772 cases with a total outcome of 0.7 million in 2021 and this is 2.5 times the number of cases identified in 2018-19 it appears that the report suggests that councils are of the view that this may directly be caused by the Covid-19 pandemic do you want to elaborate on what particular relation to the pandemic might have resulted in that increase we think it's possible to do with the volatility of the employment market during the Covid-19 pandemic and people's roles changing at the beginning and out of employment I think that it's probably the main the main driver there really and then the challenges that that presents in terms of having up-to-date and accurate information to support council tax reduction activity ok just a couple of broader questions one is given the relatively low number of prosecutions that are coming forward and also the cost of living crisis would you expect to see fraud, fraudulent activity increase during a period of economic downturn? I think it creates a higher risk environment for fraud and also for errors for some of the reasons we've already discussed this morning at the committee so I think that is plausible Mr Hoy, yes and perhaps more generally if I might say I think the report makes clear that during the Covid-19 pandemic people were conscious of the elevated risks Alan's already mentioned the briefing paper which is emerging fraud risks around Covid-19 that set out a whole range of new risks that were emerging as a consequence of the Covid-19 pandemic and obviously the cost of living crisis isn't the same thing as Covid-19 but it has some common characteristics so we think people being alert to the emerging Covid-19 fraud risks is important in the context of the cost of living crisis it's also important to say that we've mentioned earlier today there are a whole range of groups that consider fraud in the public sector and talked about some of those national networks we know that they'll also be thinking very hard about what are the new issues that are emerging as a consequence of the cost of living crisis our emerging fraud risk report set out how many public bodies had strengthened their antifraud and counter fraud activity as a consequence of Covid-19 I think it's very likely that similar activity would be taking place as a consequence of the cost of living crisis and just on that broader issue of recovery I think that the public might be quite shocked to see £15 million potentially fraud in overpayment in one single year and £160 million in total since the initiative began and yet in the year we're looking at only four cases being referred for prosecution in Scotland and that obviously doesn't mean that necessarily there'll be a legal sanction against them just looking at a couple of the case studies that you used to highlight the examples of fraud I think in relation to an example of non-domestic rates and the small business bonus scheme where a rate payer failed to declare other businesses premises resulting in £11,000 overpayment that is the first business case business rates case to be reported for prosecution in Scotland so obviously there is action there but then we see in relation to pensions we have an example of somebody who claimed £10,560 in an overpayment of £6,600 they received a police caution and a full amount was repaid and then we see a case in relation to a council tax claimant who failed to declare pension contributions and pension a pension lump sum but they effectively made off nearly £15,000 and the amount was being recovered by the council but there's no reference to any prosecution or any reporting to the fiscal so is there a sense here within the system that effectively we're getting tough on recovery but on sanction and prosecution there still seems to be quite a light touch approach I'm not sure that's the conclusion I draw from the work Mr Hoy I mean I think it's important to say that the NFI is one part of the fraud and corruption toolkit and it's not designed to solely focus on the points you've raised local audit teams both internal and external audit look at this, the counter fraud teams within public bodies look at this as well so the cases that are identified in this report are the ones that are identified through the NFI process there are other cases that have been identified through annual audit, external audit and whistleblowing activity as well I think it's probably worth me saying that the reason why we've reported this in this NFI report is directly at the request of your predecessor committee because questions were asked about so what happens when there's a fraud identified and we felt it was appropriate for us to highlight what happens in terms of prosecutions it's a small number you're quite right but it's also important to recognise that this is a lagging thing so we've identified four cases in this report there may be more that will be prosecuted in the future and there's also a risk exercise that needs to take place within public bodies about the cost benefit of proceeding to prosecution based on the actual levels of the funds involved as well I don't know how much to add anything further to that but that's our assessment of how this looks that's not to say that there isn't more work to do in this area I think it's really important to send the right signals to the public about public money counts and that there are legal activity but I don't think that I'll draw the same conclusion from the report that you drew with John yeah, thanks Anthony basically we leave it down to the individual council to speak to the fiscal or some of the councils can actually report cases directly for prosecution so it's down to their own judgement however whether they take it forward having said that I do know most councils as Anthony said does a cost benefit analysis type thing you know so if someone puts their hand up and says okay I got that wrong or you caught me and they start paying it back they tend not to take it forward for prosecution unless it's a significant value or it's a high value of interest it's a public interest case so I know in practice that tends to be what happens it is a low number but as Anthony said there are other counter fraud activity taking place which has been reported and they do report it to committees they do report cases on the websites I think that that just identifies my concern which is if you were to steal £14,000 from your neighbour then that would perceive to be a pretty heinious crime but because of the size of council budget she stole £14,000 from her council and it appears that as long as they get the money back there's no legal sanction which I think is an underlying concern that might be a philosophical point Mr Hoy can I just have a look a little bit more closely at the pilots so one of the pilots which is highlighted in the report is one that was undertaken in Fife council looking at the national entitlement cards for travel so part one of my question is how long did that pilot take place for period did that pilot cover I know you were very heavily involved in this one so Ann worked very closely with Fife council so she'll be able to give you a chapter in verse and in fact I'm conscious that we need to probably finish about 12 so I just meant that she's got an awful lot to say about this if you really want to know Thanks Ann basically it was done over the last year so Fife council volunteered to participate in the pilot fantastic of them and basically they uploaded all their national entitlement cards we use Fife council they worked with the national entitlement card office and they helped to upload the data and they worked through the matches and they worked through them finishing earlier this year in the spring time and obviously recorded the outcomes every match that we identified was a positive outcome but again I just want to inject a sense of perspective into this so over the course of a year in this pilot and presumably it's a pilot to understand whether this is a line of inquiry worth pursuing or not whether the resources required to be invested in it will reap significant harvest and so the report says out of all the cases in Fife over the course of that year 13 matches showed cause for concern as the NECs appeared to have been used after the death of the card holder two of these cards were used to journey to the value of almost £2300 I don't know where you can get from Fife 2 for that kind of money but £2300 for one and £240 for the other the value of the journey of the other 11 cards varied from £3.10 to £69 I mean one it seems to me to show how honest the good people of Fife are but secondly does that indicate that there is a major problem that requires lots of resources to be turned over to extending that from a pilot to a national level scheme I think that that's a question we're not sure at the moment we're not convinced that this is one that merits rollout across the whole of Scotland and we're reflecting on that with five council and also the bodies that are involved in this more generally in Scotland and you've been having discussions haven't you with the relevant people so I think we're just weighing that up quite hard more generally I think both in terms of the mandating of bodies participation in the NFI and indeed pilots and rollouts of new initiatives we're very conscious of the cost benefit of this it takes people's time to participate in the process that has to be real public value I think the report sets out that we would only ever want to extend if we thought that it was going to offer real benefits so if it's going to identify a small number of very big outcomes or if it's going to identify a lot of small outcomes that add up to a big number then those are the criteria that we reflect on in terms of is it worth rolling this out we're weighing that out very hard at the moment Mr Leonard in relation to the national entitlement card NFI participation in the future a single bus journey at £3.10 maybe not worthy of a major national exercise in trying to understand what's going on the other area that you mentioned is a pilot which is of interest is the pilot that is under way with Social Security Scotland and I think you're looking in particular at in that pilot whether there are examples of people who are claiming benefits as if residents in Scotland but actually are not residents in Scotland and also any cases where people have got maybe multiple addresses but are therefore putting in multiple claims how many matches have you found through that pilot I mean that they're in the process of reviewing the matches at the moment so obviously we can't report any outcomes but your question is how many matches were there I don't know have those figures directly to hand and if not we can always write back to you Mr Leonard with that I mean do you get a sense of the scale of that is it national entitlement card on the levels or is it much more widespread I think I need to just double check to be honest Mr Leonard I'm reluctant to give you an answer without being confident of the figures in front of me I appreciate that but if you could get back to us with those figures that would be helpful I'm sorry I was just going to make a more general point yes of course please I mean this is one area where we think there may be fruitful work to do depending upon what the finding of the pilot exercise is and given the increased responsibilities that we have in Scotland for Social Security seriously is a potential area of work a more general point I mean I think we've set out a number of pilot exercises in the back of the report we've touched on a couple of them today I think we're very keen to make sure that we keep the committee abreast of what decisions are made vis-à-vis any extension of the NFI in future because it feels like an important conversation for us to have with you as a committee yeah absolutely thanks for that undertaking too I'm now going to bring in for a final series of questions who has got a number of areas about future developments that he's keen to probe Willi? Thanks convener Before I ask those questions on future developments I wonder can you clarify something about the actual figure that you reported the 14.9 million that's described as an outcome Does that mean that that money is recovered or in the process of being recovered and is it ever recovered in full the definition of an outcome isn't just about money that's recovered it's also about errors that are being prevented and it's made up of a number of different components and I'll be corrected here if I get this wrong sometimes it's the amount that is being sought to be recovered from an individual if there's been an overpayment or if there's been fraud in other cases for example I think the rental issues it's a figure based on or fraud to have continued this is how much it would have cost the public purse so it's made up of a combination of different figures Mr Coffey So it's quite hard if the public were listening to this watch and they would want to know how much money have we lost and how much money do we ever get back it's never clear to me in the report which is what we're talking about whether we ever get that money back I'm sorry it's not clear to you and you feel it might not be clear to the public that's something we can go away and reflect on in the framework of the NFI which isn't something that we entirely control ourselves but there may be ways in which we can present the outcomes more clearly in the future so we'll go away and reflect on that Mr Coffey There's an element of it that is preventative fraud amounts that hasn't been defroded but might have been prevented from doing so in that figure as well and does that figure does it go back the two years to the last point of the NFI or is it in the current year so the two years ban so it's obviously based on the matches that are done as part of that exercise it's a moment in time but then it depends it would be the the frauds that were identified through that specific exercise and the amounts that are sought to be recovered from the individuals that have defrauded a public body at that moment in time alongside the projections forward for those ones that rely upon an algorithm if you like to work out what the figures are The data that it uses the commencement of the I'm obviously not making my point breaking it's based on a specific date if you like it's a census date almost so it's not going back two years it's based on a date at a moment in time but maybe you could explain it a bit more clearly I'm trying my best but I'm not going So for this report it was all outcomes reported by councils, health boards etc between the first of April 2020 and the 31st of March 2022 so that would have been the majority of that would have been related to the data that was submitted within that time but there might also be some outcomes reported in that time that hadn't been reported in the last report because as you appreciate when they get a match it takes a bit of time to undertake all the reviews especially if they have to contact other bodies to get confirmation if it's like a house in one and they have to get in touch a council down south because it appears that they've got a house down south or they're working down south and they're working in Glasgow health board or something like that so there will be it's basically everything that the bodies have reported as an outcome between those two dates but there will be some relating to the data from the previous exercise that hadn't previously been reported That's a lot clearer, thanks very much for that but now turning just to the future developments that you mentioned in the report about that there's some commentary about new types of data matching that may or may not be available to us and Audit Scotland has accessed the HMRC data that we didn't have before and we know that the cabinet office is consulting on potential new powers and expanding the powers in relation to all of this so could you tell us a wee bit more about that and whether you've been part of that consultative process where UK Government to improve this whole process Thank you very much We're very actively involved in those discussions and when we're involved in those discussions we bring to bear the views of the Public Audit Committee and your predecessor committee and the views of the Auditor General and other interested parties as well and very actively involved in those discussions On the specifics of the future developments to do with whether or not the legal powers might be expanded to cover the four bullets on that page my understanding is that the cabinet office has determined that based on the consultation feedback they aren't minded to change the legislation to expand the powers to cover those four bullets because the general consensus from the consultees was that there were risks and concerns around protecting people's identity and other issues to do with data. Having said that the cabinet office has recognised that there's merit in these objectives being achieved and they're looking to other ways of delivering those improved outcomes through strengthening the role of a specific team, I think, set up in the cabinet office that's working on this and we'll be able to give you the name of the team. That's where they're at on that, Mr Coffey. Does that answer your question or was there more that you wanted to know? It does partially, but have you got access to the HMRC editor that you did before or have you ruled that out as a bit? I thought you were talking specifically about the considerations given by the cabinet office to expand the powers so that the data that's made available can be used for different purposes. So there's no change made in our access to the data. The question that was arising here was whether or not the data could be used for purposes beyond that set out in the current legislation. As I've said, the cabinet office, based on the consultation, is not minded to seek changes to the legislation to allow the data that's available through the NFI process to be used in the bullet set out. They are keen to think about ways that the NFI exercise can be used in a more preventative way to help people to identify positives as well as negatives. They're also keen to think about ways in which we can use the NFI exercise to better promote anti-fraud and anti-corruption. I'm sure I may have missed something, so I'll just hand over to Andy Falford. With regard to the cabinet office consultation on expanding their powers, to do those at this point in time, they have said that it's not to say that they wouldn't do it in the future. Instead, they've decided to allocate the resource to the counter-fraud authority, which you might have picked up in the media around, but they were meant to launch it at the beginning of July. Obviously, down in Westminster there was a lot of political unrest and changes in the Government at that time. They have launched a counter-fraud authority, and that's what they're concentrating on just now, which is wider than NFI. With regard to the HMRC data, we are very keen to use the powers that we now have in Scotland as I think it was marched out earlier this year. We have been in discussion with the Cabinet Office and the HMRC to try and get access to that data. We put in a data sharing request in June to HMRC. When you put it in, you get an automatic response saying they're replying 21 days, they didn't reply, but we have been chasing that up. This morning, there's another meeting going on just now to try and get that data sharing with HMRC progressed. Ideally, I want to use the HMRC data on payroll pensions and there also will be data around about, obviously it's more England, but it can relate to some of our housing data sets around about those paid stamp duty, et cetera. I know that's not England, but it can still help some of ours. I'm quite positive that I don't have a timescale because, as I said, the meeting's going on just now, which we're hopefully going to tie the HMRC down to a timescale when we can actually share that data with ours. OK, thank you very much for that. I completely forgot a question that I was going to ask earlier. Of course you may. It was listening to colleagues in the amounts of potential fraudulent cases in amounts. What are the preventive measures that go in to try to prevent it? I'll pick out the blue badge example particularly. It's almost £2 million every time we look at it. Potentially defroded, let's say. What are the preventive measures that go in to try to stop that? So that the next time you sit in front of us we'll have another one of these reports, that's another £2 million. I think there are a number of different dimensions and I guess part of the preventive measure is making sure that only the right people get the blue badge in the first place. So there's a control there about making sure that people have the right characteristics that justify them receiving a blue badge and that happens within local authorities. I think what we identify through the NFI is more what happens when people's characteristics change or they fall out or they die while still in possession of a blue badge. I think this is an area where more real-time matching of data might help to be honest. And I also think that it's one where we would be looking for appointed auditors, both internal well, appointed auditors to be falling up on the findings of the NFI with public bodies as well. In my response to Sharon Dowie's question we said that this may be a blip as a consequence of Covid-19. I think we'll be wanting auditors to follow up on this in terms of are people learning the lessons of what we found in this NFI report and obviously when we do the NFI in two years time we'll be able to see whether or not there have been improvements in that area. It just seems to me that year on year are two years year on year. It's the same event that's potentially defrodded through someone with a blue badge scheme and surely the public would expect that that should go down with countermeasures and these NFI initiatives that go on. Why doesn't it go down? The public might ask. I think I might want to add something to my response to cover the matter. Illuminate a bit more on this, if that's okay. With regard to the preventative measures obviously it's councils that are impacted by the blue badge and the councils obviously they do report to their audit committee and then tend to put stuff on the website and know about what we've identified this, Bladda Bladda, Bladda, Lavercatch and we're clamping down on that so they do sort of promotion type thing. They also use the sort of tell as ones they promote the tell as ones so that as soon as someone dies they're getting informed and as Anthony said ideally real-time information would be the ideal. So it's more promotion. We'll look forward to the next report. Thank you. Without putting the words in the witnesses' mouth earlier on you had said in answer to the initial question that was put to you that obviously the incidence of mortality amongst people with disabilities was higher than the general population and that might explain why there is a rise during this period of time and I think it's worth waiting to see what the next round of NFI results tells us about that before we jump to any conclusions. I think, yeah. We've got a very last question from the deputy convener, Sharon. In a letter of 30 May the cabinet secretary for finance and economy confirmed that she was keen to support audit Scotland with any legislative changes that were required beyond any changes resulting from the cabinet office's consultation. She confirmed that officials would continue to work with audit Scotland to further improve engagement with the NFI in Scotland. Can you tell us how this has been taken forward? Ann has the operational engagement with both the NFI team so you might want to tell us a bit more about that. Yeah, thanks, Antony. We have obviously speak to the cabinet office on several times every week and we also meet regularly with the Scottish Government both they've now got a head of counter fraud in Scottish Government as of last year so we engage regularly with him and we also engage with the Scottish Government risk team who actually pulled together the response from the cabinet secretary and the action plan that's attached so we regularly engage. The engagement wasn't so frequent during the pandemic just due to, you know, everything was really difficult to try and get audited bodies to do more in relation to the basic on NFI but we have opened up a few months. So there's not a lot of progress when we're doing it? I think I'm specifically asking are there any plans to make changes to the primary legislation? There are no plans at the moment that we're aware of to make changes to legislation. We are still in on-going discussions with Scottish Government officials and the Cabinet Office about whether or not they may be needed and I think that's something we want to continue to discuss with you as a committee as well and we'll obviously take the feedback from today's discussion through to our discussions with both Scottish Government officials and the Cabinet Office. That's one of the purposes of coming to you today. Okay, well thank you very much indeed and can I thank both Anthony and Anne for your time and for the level of information that you've given us this morning? I think that's been really helpful giving us some direct answers to some quite important direct questions that we've been keen to put to you. Once again and we shall no doubt see you in the future on this subject but for the time being can I suspend the meeting in order to allow a change over of witnesses? I'd like to resume this morning's consideration of evidence by the Public Audit Committee with agenda item 3 which is our continuing consideration of the Auditor General for Scotland's section 22 report on the 2020-21 audit of the Commissioner for Ethical Standards in Public Life in Scotland. Can I welcome our witnesses this morning? We are joined by Maggie Chapman MSP who's a member of the Scottish Parliamentary Corporate Body. Alongside her is David McGill who's the clerk, chief executive of the Scottish Parliament and Hugh Williams who is the private secretary head of office to the Scottish Parliament. We've received your written submissions in response to a letter that was sent in my name as the convener of the Public Audit Committee and Martin Whitfield's name as the convener of the Standards, Procedures and Public Appointments Committee so we shall no doubt turn to some of the issues arising from that in the questions that we've got. We have set aside obviously some time for more questions from members of the committee but we'd like to offer you the opportunity to make a short opening statement, Maggie. Good morning, thank you very much for that and thank the committee for giving us the opportunity to discuss the governance of office holders with you all this morning. I'm very pleased to be here on behalf of the Scottish Parliamentary Corporate Body and I would like to begin by saying that the corporate body takes very, very seriously. As members of the committee will be aware we have submitted a paper outlining the role of the SPCB and setting out the current governance arrangements. You will see from that paper that we detail further enhancements that can be made in the light of the section 22 report on the office of the Ethical Standards Commissioner and I would be happy to provide the committee with information on the progress we have made. What we do not cover in that letter are the enhancements to the governance since 2002 made as a result of a number of reviews. These included a report on shared services by Audit Scotland in 2006, a comprehensive review undertaken by the then finance committee in 2006 into accountability and governance of office holders, the CRERA report into complaints handling and in 2009 an ad hoc committee was established to examine the office holder's landscape. There were common themes coming out of these reviews, some of which are pertinent to today's meeting. These are the need to define and standardise the governance structures subsequently delivered by the Scottish Parliamentary Commissions and Commissioners etc Act 2010, the role of the Parliament and the need for proper scrutiny and accountability of organisations funded by the public purse. As a consequence, standing orders were changed to enable this to happen. To be clear, the position of the SPCB is that the SPCB has responsibility for governance and it is parliamentary committees that have the scrutiny role for functions undertaken by each office holder. Finally the need for shared services. This is happening and the co-location of several office holders offers more opportunities for future efficiencies. Thank you, convener, for allowing me to place this on the record and we are happy to take any questions you might have. Thank you very much indeed. Before I turn to Sharon Dowey, my observation would be that this committee is in particular interested in the history of reviews but then in the history of the outcomes that those reviews produce. So Sharon Dowey, I'm going to ask you to open the questioning for us. Thank you, convener. Good morning. Your submission refers to existing governance arrangements that SPCB has in place for office holders. This includes the requirement to adhere to a memorandum as well as a suite of strategic engagement documents. Is compliance with the memorandum and these documents monitored as part of the annual evaluation process undertaken by an independent assessor? Thank you for that question. Yes, as part of the governance structures we have on appointment the office holder receives an appointment letter which outlines the functions and the duties that they are expected to carry out. If they are also the accountable officer, they get this memorandum that sets out all the strategic documents as you say. The reviews and how these are evaluated and assessed are part of the annual process that is done by the independent assessor, but it will also be something that the internal and external audit functions that are in place or should be in place will take those into account as well. Did that pick up any non-compliance by the commissioner's office during the 2020-21 reporting period? One of the issues that we had with the 2020-21 year was that the former ethical standards commissioner did not make use of either the advisory audit board that we would normally expect to be in place and instead had another audit function that there was very strong advice given by the Scottish Parliament corporate body to not engage the audit process that she did do so. But the corporate body couldn't direct that. The corporate body was limited by statute in the powers of direction that we could have as part of the wider scope audit that was undertaken, that was when concerns began to be to be discovered. David, if you wanted to say a little bit more about that. In relation to the independent assessor that process finally ran into the sand unfortunately because the former commissioner disengaged from it. That flagged up to us a bit of a weakness in the process. The process allowed for an agreed report to be submitted to the corporate body but in the absence of agreement on the report there was no facility for that then to be submitted to the corporate body and that's one of the changes that we're seeking to make to the process to make sure that if in future any officer disengages from the process there will be a mechanism for that unagreed report to be submitted to the corporate body. A full review has been done and actions have been taken on that then on the issues that were found. Actions are ongoing there have been some changes made but part of the process we don't just want this to affect the ethical standards commissioner we want to look across all office holders that corporate body has responsibility for and part of that negotiations and discussions about exactly what those processes are and that is under way as part of the appointment letter and as part of the memorandum that we are going and I don't know Hugh if you wanted to say a little bit more about. Just in terms of the ethical standards office there is now an internal audit function there is a function in AAB that is providing valuable advice to the acting commissioner. We are looking again at the independent assessment that you make about ensuring that the government's arrangements are there is something that we can take forward as part of that review. You mentioned it was an annual process is there something in place so that officials are highlighted before the annual review takes place that action will actually be taken then so that it is timely rather than waiting to an annual review? I think we look more towards the AAB sorry the advisory audit board on that but it is something again we can look at. I suppose the other thing to say with that is following discussions with office holders what corporate body officers have instigated is a regular conversation with all office holders usually about quarterly and hopefully that will also act as an informal mechanism of identifying issues it's not part of the audit process but it's part of that wider communication and broader engagement that we know is necessary. In previous parliamentary sessions it has shared a paper with the relevant clerks on what areas the SPCB considers that committees should be scrutinising office holders on. Can you confirm whether that took place during session 5 and if not whether the SPCB intends to assume that practice during session 6? I think on that point what the corporate body has done now as part of its review is that it has written recently to the committee community members group looking to see some of the points highlighting the section 22 report was about the scrutiny function so we're looking at seeking agreement in principle from committee community members to a written agreement whereby this could set out the role of the corporate body the role of committees and what functions they could be undertake. I think once committee community members have agreed in principle if they do so we can then look at the detail of the written agreement and bring in the points that you raise about looking at more committee engagement and what sort of engagement that should be. So this is working progress at the moment then? Yes. Is there a timeline on it? We only wrote to the committee conveners last week so I think it's subject to obtaining agreement from committee conveners. Is that something that this committee could be updated on? Of course. Can I take you back to Sharon Dower's initial question there which was that in session 5 did the practice of inferring with the clerks about areas the corporate body considers that committee should scrutinise officials on, did that take place in session 5? Yes or no? I think the answer to that was sporadic, yes. I think the corporate body's proactive approach to instigating that was probably lax in session 5. I think there was a reliance on the fact that historically standing orders have been changed to oblige the clerk of the Parliament to submit annual reports to committees and that would trigger the committee's scrutiny of it so the corporate body did not follow up on that to see that committee's scrutiny was taking place. So I think in some instances there was good engagement between parliamentary committees and office holders and in other cases there weren't and I think also it's worth saying that for at least one of the office holders the information commissioner for example it doesn't fit neatly within the remit of parliamentary committees so there's a challenge there to make sure that that body and that office holder is properly scrutinised by parliamentary committees. Thank you. In a sense one of the things that we are interested in is the gap that may exist between the theory and the practice and whether what you've outlined is good practice is being followed through and was it followed through in session 5 and how did we come to this and I guess one of the underlying issues here which I think was outlined in the letter that Martin Whitfield and myself wrote to you initially around our concerns that came out of the section 22 report by Audit Scotland was that how could things have got to this stage without there being a much earlier intervention. Can I turn to again something else that's referred to in the correspondence which is about enhanced government enhanced governance arrangements which again in the report the expression uses that they had deteriorated to a significant degree so it is a record of there being quite some quite deep seated problems that exist into institution almost and could you perhaps outline to us what progress you've made in that area of enhancing the government arrangements and seeking to address what clearly have been deficiencies that have led us to the situation that gave rise to the section 22 report into the Ethical Standards Commission. Okay, so I'll start and then ask David and Hugh to pick up anything that I miss out. I think it's fair to say that we are in process of the enhancement of governance structures and arrangements that we want to see. We are reviewing material provided to new office holders to satisfy ourselves that all governance relationships with the corporate body and Parliament more generally is accurate and is accurately stated and that will be part of the appointment letter and the terms of engagement that office holders have. We are looking to introduce a code of conduct and that will be done in negotiation with current existing office holders as well to make sure that there aren't any changes or unexpected new things that they have to do without their engagement in that discussion as part of the process. We want to make sure that arrangements are made by office holders to have access to an internal audit function and we know that for all commissioners that is the case with the exception of the biometrics commissioner who is the newest commissioner but that process is in place. To get that internal audit process is under way. We are also seeking copies of all external reports and that will be part of the regular procedures that corporate body undertakes on a regular basis. As I say at an official level meeting formally with office holders on an individual basis quarterly arranging for the SPCB portfolio member who holds responsibility for office holders to be in some of those conversations when appropriate. I suppose just on those regular quarterly meetings I suppose it's important to state that they aren't only corporate body business agenda items that will be discussed. Office holders will be encouraged to engage with setting the agenda for those conversations to be able to raise issues. We want to very much make this a conversation, a two way communication process rather than it being we need you to do this or we need you to give us this. So there has to be that dialogue and I think it's fair to say that corporate body is of the view that we need to improve communications across the board. It's not just between corporate body and office holders as people have already indicated we need committees to be involved in that process as their responsibility for scrutiny and operational functions but there are also others such as the standards commissioner for instance being part of more broad conversation and communication to try and ensure that that kind of thing doesn't happen again. I don't know if you or David want to say anything else about that. I think Maggie Chapman has given some of the details of the changes that we're seeking to implement here but taking a step back these have come out of a third of going review that we've instigated of all of the ways in which the corporate body gets a students on governance framework around office holders and there are five ways in which the corporate body does that. Firstly external audit overseen by Audit Scotland and the discussions we've had with office holders they've reported to us that that process works very well however it may be focused very heavily on the financial aspects of it and I've spoken informally to the Auditor General about the possibility of the scope of that being extended more into governance areas that's obviously a matter for the Auditor General. Secondary is the independent assessive we've spoken about the weaknesses in that the changes that we're going to make there. Thirdary is the advisory audit board function and there were particular reasons in these circumstances why that broke down that we're addressing. Fourthary is the annual certificate of insurance that office holders are obliged to submit to me as the principal accountable officer and finally the area of committee scrutiny that we've touched on again. The review flushed out that there are weaknesses in all of that but this was on the basis of 20 years of this working well and what we hadn't anticipated and what we hadn't designed into the features of all of this was for the possibility of an office holder disengaging from the process and that's a perspective we've taken as part of this review and it's led to some of the improvements that we've taken. I'm anxious to move on. I've just got one almost factual question to put to you which is that I think since April 2021 the head of corporate services has been the accountable officer for the ethical standards in public life Scotland commission. We understand that you are in the process of recruiting a new commissioner for ethical standards in public life. Will that new post holder also be the accountable officer? I think that's a good question and I'm not sure we have a definitive answer on that yet. I think at the time when the acting commissioner was appointed it was appropriate to split the role and as you've seen in comments from the auditors that's not an unusual situation. At the time that decision was taken so the acting commissioner could focus on remedying the issues that had arisen in the office breakdown of relationships, backlog of work load, all those kinds of things. I think that there's something to consider further with the new commissioner when they are appointed how that has been going and whether it would be appropriate to retain that split for a limited period of time or to revert back to combined roles. That is a conversation that we would have with the new appointee. Does that wouldn't be something that you would prescribe? It wouldn't be part of the job advert and the job description for people applying for that post. I haven't looked at what the job advert says. Does it say you will be or you may be or you might not be the accountable officer? The expectation is that the job does have those two roles combined but given the situation that we are in with this specific role I think it would only be fair to the incoming commissioner to be fully open about why it's not been combined for the last 18 months and what the process for the future looks like. Sorry, but do I infer from that Maggie that you're saying that your expectation is that that new post-holder will be the accountable officer? Okay, thank you. Willie Coffey has got some questions. Thank you very much, convener. I just wanted to turn to the auditor's report on recommendations. We're not at committee member. We're always keen to follow up on whether recommendations are accepted and in process I understand there are 22 recommendations made, some of which apply directly to the SPCB. For example, one of them was about reporting routes for various concerns. We clarified what we're doing with reviews of the overall governance structures. And also a point about continually assessing whether these things remain adequate. There's an interesting quote from the presiding officer in paragraph 6 that says there was no follow-up from the auditor prior to or following these recommendations. So the question for me is did we embrace, have we embraced these recommendations in any case and are we carrying them through? So, yes, Corporate Body does recognise and take on board all of the recommendations, particularly the ones that are through that refer directly to corporate body functions. I think it's fair to say that there hasn't been the auditors didn't engage with corporate body formally as part of this process and I think that's as I said earlier, I think one of the things we want to do is make sure that we do have the genuine engagement across all of the interested stakeholders and interested parties whilst ensuring that we aren't seem to be interfering because obviously the work of the commission has to be independent of corporate body and of MSPs, members and Parliament. So in terms of do we accept the recommendations? I think there are the recommendations that apply directly to the functions and powers of corporate body, yes and we are working to ensure that we implement the changes that are needed, including around governance. There are some connections with those two operations and the functions of the commissioners office and it would be inappropriate for us to direct in that view but I don't know David if you wanted to say or hear a little bit more about that. I think one thing I would add is that we do take the report very, very seriously and we are looking at governance particularly so that we know that there are more commissioners coming in the pipeline. The corporate body is likely to be invited to take on more commissioners so we really do need to have the governance framework working as it should be. Just to get that assurance from you Maggie that the recommendations that are aimed at yourselves are in training and being worked on. Yes absolutely. I'm going to bring Willie back in later on and I'll switch to Craig Hoy who's got a couple of questions to put. Craig. Thank you. Good morning Mr Chapman and other witnesses. I just want to focus in just a little bit on the progress that's been made since obviously this situation emerged. It's quite clear that the Auditor General's report identifies that relationships have deteriorated to a pretty poor standard. So how have those working relationships between the commissioners office the standards commission and the corporate body and the committees of the Scottish Parliament improved since let's say then Nadia? So thank you for that question and I think the work of the commissioner would be impossible and I think maybe not impossible but nigh on impossible without good relationships across the board and I think that's what we saw break down with the former commissioner. The acting commissioner has worked with stakeholders including corporate body but external stakeholders as well to rebuild trust and to rebuild just that communication process which had become nonexistent and I think when the acting commissioner gave evidence to another parliamentary committee earlier this year outlined exactly what he had done in that. So he'd engaged with local authorities he'd engaged with chief executives and senior managers of local authorities through Solace and he'd engaged with other public bodies that would ordinarily we would expect to have a relationship with the commission. So the acting commissioner has done a lot of work over the last 18 months to rebuild trust to rebuild that engagement and I think it's important to say that part of that has also been the work that he has done to support the staff in the commissioner's office to make sure that they are able to reach out to people they need to speak to and that they will get the kinds of information that those relationships can be rebuilt to ensure effective working across different public bodies. Just in relation to something you said earlier Mr Chairman, in relation to improving communications between all the relevant stakeholders obviously public trust is important in this as well you know that there's been quite considerable media interest in the weaknesses and governance at the Ethical Standards Commissioner from a corporate body point of view do you think that you have effectively communicated and do you think that you've had sufficient levels of transparency both in relation to parliamentary inquiries and also media inquiries that have come in in relation to the activities within the office and the corporate bodies role within that? Can I just be clear that you're asking about how we've communicated to the public or to commissioners to... Yes, as the corporate body both within Parliament and in relation to media inquiries that have come to the corporate body do you think that you've had sufficient levels of communications and transparency in relation to your dealings with external agencies principally? Okay, so some of the media inquiries that we've had refer directly to the former commissioner and it would be inappropriate for us to comment publicly at any point in this process about that and I think our communications were clear on that in terms of the actions that have been taken and that have been put in place I hope that we have been clear and transparent in what corporate body has done what the acting commissioner has been seeking to do over the last 18 months in terms of answering challenging questions I think that there are boundaries of responsibility that we are aware of here as well so as we've really indicated there's a role for corporate body in ensuring governance processes are in place the commissioner's officers have a very clear responsibility in making sure that happens and there are limits to the extent to which we can then direct if commissioners and office holders disengage I think there's also a clear opportunity for us, as David and Hugh have indicated to improve discussion between corporate body and committees and I think that we've been open about that to say that we want a stronger relationship between the corporate body and the committees that scrutinise the functions of the office holders and I would welcome that on-going process to continue Okay, just in relation to compliance with standards commissions the statute directions were issued at the commissioner's office in 2021 for the first time in April 2021 the standards commission included that there had been a contravention of the direction and the convener of the standards commission should send the Scottish Parliamentary Corporate Body a formal complaint just looking at the position today regarding compliance with the standards commission's statutory directions are you confident that they are being upheld? Yes, okay, fine Just wondering if you perhaps give the committee an update in relation to agreeing and implementing a full investigations manual that could be used moving forward is there an update you can provide in relation to that? I can probably say that the manual is in process Hugh will be able to give a little bit more detail on the specifics There is a manual in place coincidentally just yesterday the commissioner has consulted stakeholders on an update to the manual on the importance and transparency he is this time looking for views from the likes of the corporate body committees and other external stakeholders about the manual Are you confident that it would be sufficiently robust? Yes, okay I'm not sure Mr Williams this committee believes in coincidence but we would be keen to be kept abreast of the progress that you are making because that was an important recommendation in the Audit to Generals report I'm going to bring back in Willie Coffey who's got another couple of questions he wants to put before I turn to least but not last or last but not least Colin Beattie It's just really a follow-on from the question asked by Craig Hoy the auditor also said that all the eligibility decisions about assessment criteria should be reviewed externally by an external investigator I think it was in the auditor's report is that could you clarify for that, it's been done so a dive in are you going to impact this? First of all that's obviously a matter for the acting commissioner but my understanding is that the acting commissioner has taken legal advice and there are legal barriers to the reinvestigation of historic complaints How could you advise this committee about the outcome to that because we're clearly interested in following through the recommendations to make sure that they're active He's taken advice on that and decisions once they are taken cannot be reopened they could be used as a learning exercise for staff The acting commissioner we understand has discussed this position with the standards commission and he has also advised the external auditors of the position he has to act within the statutory legislation that is in place for him Is that something you could update us on at an appropriate time Maggie Given the decision that the legal advice or the inability to reopen those decisions the standards commissioner has been advised of that and is content with that process I suppose if anything comes back from the auditors that is something that we can certainly update committee about The other question is you made mention of yourself, Maggie about funding implications of all those reviews and processes and the impact on workforce planning and so on Could you just say a little more about that? I think one of the challenges that the acting commissioner has been dealing with over the last year is putting into place some of the HR processes that we would expect to be in place that had fallen away so things like performance management processes every staff member within the commission now has an individual action plan around their own performance, what's expected of them there's been training and guidance issued on a whole suite of activities including how to deal with some of the increasing complexities of cases that the commission officials have to deal with I think it's also worth noting that the corporate body will be discussing next week the business case which includes workforce planning as part of that detailed workforce plan we had hoped to discuss that a couple of weeks ago but that meeting was postponed because of the morning period so that meeting is taking place next Thursday Can I just pick up again that point that Willie Coffey alluded to I mean the paragraph 18 of the Auditor General section 22 report points out that in 2016-17 43% of complaints against councils and board members were not pursued further but by the time we get to 2021 84% of cases lodged were not pursued now there might have been an increase in vexatious cases possibly inflating that number but the Auditor General's conclusion talks about a loss of corporate memory significant staff turnover it is likely attributable to a change to the way in which incoming complaints were initially assessed so I hear what's been said about we've taken legal advice and you can't reopen cases and so on but if I'm one of those people who's lodged a complaint about the misconduct of a councillor an MSP a board member from an NHS board or whatever and lodged with an organisation which clearly was malfunctioning do I not why is it so categorical that the door is closed to me to raise that with an organisation which has now been made fit for purpose which according to the section 22 report wasn't at that time and I can understand where that question comes from and the frustration that some people may well feel Corporate body doesn't have the power to direct the commissioner to reopen and reinvestigate that is up to the commissioner to take that decision and having sought legal advice the acting commissioner has been very clear that he cannot do that what the acting commissioner has done as indicated in an earlier response is advise the standards commission of this and standards commissioner is content with the rationale for that I think that the broader point around making sure that cases that are still not dealt with are dealt with effectively and that is why Corporate body will be discussing the workforce plan which includes additional resources to deal with open complaints next week but that sounds a bit like the institutions are happy but what about the complainants you don't need to answer that question Colin Beattie thank you Over a period of many years now this committee has sat and looked at report after report from the Auditor General which highlighted failures in governance and it seems at times that it's almost endemic and it's really despotant that the SPCB falls into the same category it seems like an extraordinary failure in governance and I would ask you quite simply was your governance fit for purpose during this period I think as we have attempted to outline already that there were things that we are in the process of strengthening which implies that they could have been stronger previously I think that one of the things to be clear about is again the boundaries of responsibility Corporate body has powers to act in certain instances one of the really important elements of office holders work is that they are independent of direction from corporate body so whilst corporate body can provide funding can provide the approval or otherwise of annual budgets approving staff numbers, staff structures the corporate body has a role in overseeing the governance structures and we can contribute to and comment on strategic plans and the like the governance functions of the external auditors and the internal auditors really are what bolsters what bolsters that and as we saw with the Ethical Standards Commission the former commissioner disengaged from us, disengaged from the external auditors disengaged imposed external auditors that we advise that corporate body advised her not to do and I suppose the way that we have closed that gap if you like what we are seeking to do is in appointment letters and in the code of conduct that Hugh referred to earlier failure to engage will become a breach of the relationship a breach of appointment that wasn't the case previously we hope that in the future that will be the case I know a lot of what you're saying is very similar to what we've heard in other instances of governance failures where there's a lot to be done afterwards but during the time the governance was weak at what point did you actually realise that the governance structure was failing David, do you want to on your initial point I entirely understand the question but I'm not sure that I would characterise the governance framework is failing in this instance I think what we're saying is that aspects of it were not strong enough for these particular circumstances but I would stress that this framework has been in place in pretty much the formats in just now for the best part of 20 years and we've never experienced a circumstance like this before I think one of the biggest areas of weakness that we've identified is that failing between things that fall between two stools on the corporate body's responsibility for governance and on the committee's side for functions and some of the failings that have been identified here are failings of functions so they were not things that the corporate body would necessarily be responsible for that said but you would have sight of it sorry you would have sight of it as Chapman's already described as your oversight in coming to your second question when we started to become aware of these failings it wasn't one particular or single instance it was a number of things that happened around about the same time so for example the first thing we became aware of was the dispute between the former commissioner and the standards commissioner on the directions around about the same time we were in discussions with the former commissioner about her views on an advisory audit board which were very much odds with our views on that as Maggie has said that's not something that we the corporate body has the ability to direct on but we very strongly advise that she engages with external auditors on the concerns that we had and again we've talked earlier about the difficulties with the independent assessment and that came around about the same time so there were two or three different avenues of concerns that were coming to our attention around about the same time which was summer to winter of 2020 Were you satisfied that you had sufficient processes in place to highlight when these issues were coming up for example when were you cited on the fact that there were statutory directions coming from the standards commission which is quite extraordinary as an event We were made aware of that I think in August of 2020 there was a a dispute about the ability of the standards commission to issue those directions so we took legal advice on that our view was very much that the standard commission had that statutory ability that wasn't accepted by the other party so we took our legal advice and then communicated that legal advice to the former commissioner and that was the extent to which the corporate body given the fact that we cannot direct the standards commission can but we cannot direct that was the extent to which the corporate body had the powers to intervene in that dispute Were you automatically advised of these statutory directions? No, we weren't there was no matter entirely for the commission there was no provision in the statute for them to be automatically transmitted to the corporate body and yet it's an indication of failure of governance potentially within the commission potentially yes the ability has always been there in the statute to make sure that the overall governance framework works smoothly but they hadn't been recosed issuing directions before that point but you had substantial influence over the commissioner given given your role and you do have an oversight role there how did you engage with the commissioner? Was there regular meetings? Was there exchanges of information? There was yes we do have influence to an extent but as we've pointed out we don't have any powers of direction and the office holders are appointees rather than employees so we don't have the influence that you would have over an employee but yes I met with the former commissioner on two occasions and I engaged in lengthy correspondence over a period of months with her on all of the issues that we've discussed this morning So where would an escalation process be? The governance broke down your relationship presumably became a bit strained given the differences of opinion and so forth Where would you normally go from there? How would the escalation process work? The escalation process depending on whichever issue it was that was being escalated would be normally through parliamentary committees or straight to the Parliament escalating it to that level Again it's an impasse on various issues and that was then compounded by the former commissioner being on extended leave for a period of time so we did not have the ability to continue the engagement that we've been trying to maintain with her Given the failure within the organisation given the fact that the longer inaction on the part of SPCB is concerned would lead to unfortunate outcomes in terms of investigations on being carried out would it not have been appropriate to bring it to Parliament to bring the problem to Parliament? I think because of the impasse that was reached and because of the position that we were confronted with with the commissioner being on a period of extended leave the corporate bodies focus was very much on ensuring that the governance framework was improved and was working to a satisfactory extent and that's why the corporate body appointed an acting commissioner on the first place that's why they separated out the roles of commissioner and accountable officer corporate body also moved very quickly to respond to a relatively modest request for an increase in the staffing complement to allow the acting commissioner to respond to the issues that were being addressed so the corporate bodies focus was very much on getting the office back on track and making sure that they are part of the ethics framework in Scotland was working as it should be Given that practically everybody staff almost everybody you couldn't point it in the commission was under performing for various reasons would there not have been a degree of greater urgency of necessity to act swiftly to rectify the situation much more quickly than it appears to have happened given the time scales that's something that I'm more than happy to look at but I don't recall a lack of urgency I think the corporate body did move swiftly to make sure that the office was functioning the way that it required to function give me a time scale I think in the early part of 2021 when we were reaching an impasse on various issues and the former commissioner went on extended leave the corporate body moved immediately to appoint an acting commissioner and focussed its energy on working with that acting commissioner to get the office working in the way that it should be I suppose it's worth saying that prior to the former commissioner going on extended leave attempts by corporate body to contact her to engage with her and those attempts were ignored even when deadlines were given and very clear requests for information were made I think one of the ways in which we hope to ensure that that can't happen again is make that kind of disengagement a breach of the appointment guideline so that would be we didn't have those powers there and the new terms and conditions for future appointments will include that as a breach what would have happened if the previous commissioner hadn't gone on leave and you continued with the impasse what would you have done? I think it would have been at that point that we would have sought to use one of the mechanisms that corporate body has to bring the issue to Parliament so an office holder could be removed from office if the corporate body is satisfied that they breach their terms and conditions as I said there wasn't a clear breach there because disengagement wasn't one of the terms and conditions but I think what we would have been able to do is have a discussion with Parliament about whether we'd lost confidence in the commissioner that would be the only mechanism open to us but because the former commissioner went what was on extended leave we couldn't engage in that process I think one concern is over an extended period was obviously a lot going on in the background it's a question of transparency around all this because for many many months complaints were coming in being dealt with not being dealt with people's futures were being recognised in one way or another potentially and over that entire period whatever was going on behind closed doors was not really contributing to that would it have been better if this had been a more open process if sorry can I just understand what had been a more open process if the problem and the efforts to resolve it had been more open I think there were challenges around who knew what when and one of the things that we have and are putting in place I think they are in place across all commission all office holders now is a whistleblowing process for staff there wasn't a process where staff could raise concerns with an external with an external body the process was an internal one through the commissioner and obviously that in this case wasn't appropriate and we have now ensured that there is a process for all staff in all office holders it seems that you are backfilling deficiencies that were in place under the previous system and that in fact the previous system wasn't actually fit for purpose and you are now trying to put something in place that will be hopefully when will you be assessing the new governance structure that you've got when will there be some sort of assessment available on that so that is an on-going process that corporate body is undertaking looking at the different documentation that currently exists how we seek to amend that the code of conduct that will be part of the appointment of of office holders that Hugh mentioned earlier I think it would be appropriate once all of those changes are agreed across all office holders that the body will then take a look at how things are functioning once all of that has happened but we are still undertaking the work required to meet the recommendations of the section 22 report Are you working with Audit Scotland on this at all? I'm thinking of some sort of independent review once you put the amended processes in place to get an independent review as to the adequacy of them given the problems in the past Hugh, do you want to? We can certainly look at that I would certainly recommend it given the experience that like Audit Scotland had elsewhere with similar governance failures That's a helpful suggestion Thank you On that constructive suggestion by the committee to our witnesses can I draw this morning's evidence session to a close and thank Maggie Chapman, David McGill and Hugh Williams for being prepared to come to the committee this morning and to answer the questions that we've got and to respond to what is, I think, by common consent has been a very difficult situation and has raised some pretty fundamental questions about the governance structures and whether or not they needed to be reformed As I said, we are a committee that is principally concerned about outcomes and not necessarily reviews but we'll be keeping a close eye I'm quite sure we'll discuss our next steps but I'm sure we'll be keeping a close eye to understand how effective any changes that you've heralded are implemented but thank you once again for your time this morning I now close the public part of this morning's meeting to a close Thank you