 I welcome everyone to the 11th meeting in 2022 of the Public Audit Committee. Before we begin, can I remind members, witnesses and staff present that social distancing arrangements need to be respected and that if you are moving around the room or entering or leaving the room if you could wear a face covering whilst you are with us at the table, you do not have to wear a face covering. The first item for the committee is to consider taking agenda items 4, 5 and 6 in private. Are we all agreed? I have a cent for that. The next item on our agenda is to look at something that the committee has taken an interest in over a number of years, which is the oversight and governance arrangements for major ICT projects in Scotland. We have with us this morning to give evidence on that, a number of representatives from the Scottish Government. Sharon Fairweather, who is the director of internal audit and assurance, Geoff Huggins, who is the director digital, Jonathan Ruff, who is the head of digital strategy and policy, and Donald McGillvery, who is the director of safer communities. We are going straight into questions. I want to begin by asking something that is a matter that is praying on many of our minds. The National Cyber Security Centre has issued organisations with guidance about what to do given the heightened state of alert around cyberattacks. I wonder whether one of you could tell us whether the Scottish Government has been having discussions with public sector bodies about the heightened risk of cyberattacks in light of the Russian invasion of Ukraine? I think that one is for me, convener. The short answer is yes. We are aware of a heightened risk on the back of the Ukraine invasion. Russia, as a state actor, and some non-state actors are a particular threat in the cyber world. As you say, the National Cyber Security Centre has set out a heightened state of awareness. We have been very active in pushing that out and amplifying that to our public bodies in Scotland. We have regular meetings of our National Cyber Security Partnership. We have a monthly bulletin, but we have gone out with specific communications to all public bodies to make them aware of the heightened threat at present. There is no specific threat to Scotland or the Scottish public sector at the moment. It is very much a case of heightened awareness, making people aware and being extra vigilant, but I would want to stress that there is no specific threat to Scotland at the moment. Has the state of alert been increased in light of events that have unfolded over the past few weeks? As I said, we have been very active. We have a very much established network of cyber security professionals across the public sector in Scotland, and we have been very active through that network, drawing their attention to the NCSC alert and the NCSC guidance, reinforcing some of our core messaging around cyber resilience, standards, tools, those things. That is absolutely the space that we have been in over the past few weeks. For the sake of completeness, there have not been any cyber attacks by Russian sources over the past six weeks. There have been a couple of incidents, cyber incidents, that have been reported to us over the past six weeks. There is one that is in the public domain that is the Scottish Association of Mental Health that suffered a very serious cyber attack a couple of weeks ago. There is none that I am aware that we have traced, that we have linked in any way to the Ukraine conflict or specifically to a Russian threat linked to Ukraine. Incidents happened from time to time. I am not aware that the recent incidents over the past few weeks have any specific link to the Ukraine situation, convener. Thank you, but you clearly remain vigilant. Just in terms of what we are doing within the Scottish Government ourselves for the technology that we are responsible for, we have been working with NCSC through the checklist of additional measures that they are recommending. That is an evolving checklist. My team are meeting weekly with other public bodies in terms of information sharing. During the past four or five weeks, we have run a cyber tabletop exercise to get a better understanding of how we would respond in that context. We have seen some additional activity. One of the reflections on that is that it may not be directly linked to Ukraine or Russia, but it may be within the context of that. Militiais organisations are able to operate under the cover of that and in the shadow of that in a way in which they might otherwise not have done. We are continuing to be vigilant. We also have increased the risk in respect of the likelihood on our risk register. We have had conversations with our executive team and brief ministers and kept them involved in what is going on as well. What we are doing is what each public body will be doing across Scotland. We may return to those things later on in the session, but I will now turn to Sharon Dowie, who is joining us through a video link this morning. Audit Scotland 2019, enabling digital government report, noted that governance and management structures for overseeing the 2017 digital strategy was confusing and that the roles and remits should be kept under review and clearly articulated. Could you tell us about the governance and management structures for overseeing the delivery of the Scottish Government and COSLA digital strategy that was published in March 2021? I will be happy to pick that up. Following the publication of the strategy last year, across the summer and into the autumn of last year, we worked with COSLA to put in place appropriate overarching governance arrangements for the strategy. There is now a joint ministerial oversight group that will meet four times a year focused on the delivery of the commitments within the strategy and the benefits realisation. It met for the first time at the beginning of March. The agenda focused on the reporting arrangements in respect of the different commitments. The intention is that it will meet again in the summer and then in the autumn. We will refine that approach as we work through it, identifying those people accountable for particular commitments, looking to the wider benefits that we are seeking to deliver and that, quite often, you can do all the things that you said you were going to do but not get the benefit that you said you were going to achieve, so thinking beyond simply the particular deliverables and using that both for internal management of the strategy but also external public reporting in terms of what is actually being achieved under the strategy. In addition to that, within the Scottish Government, we did a piece of work across the autumn looking at what we might describe as the connective tissue in terms of how we deliver digital functions across a complex organisation in a way that can give us assurance and confidence about what we are doing. As part of that, we will be reforming and changing what was previously the central Government digital transformation board to create a digital board that brings together senior directors within the Scottish Government, along with representatives of the NDPPs and the delivery agencies. The intention is that it will be the staging post for the material that goes to the ministerial cosla group in terms of confidence about delivery, but it will also look at the horizontal issues, the things that we need to do across Government in respect of many commitments and many projects, so GDPR assurance capability, those areas that are a key ingredients to a successful delivery of a programme of work. We anticipate that it will meet in its new format in June. That will be the first meeting in that format. We have taken quite seriously the 2019 report, and it was a key document that we were looking at as part of that review that we did internally in terms of how we operated. On the other side, it is helpful that you mentioned that this was a joint strategy. It is a first joint digital strategy. We are aware that the local government digital office, cosla and solaces have also been working in respect of their commitments under the strategy to identify appropriate governance and co-ordination work to work across the 32 councils, but it is probably not ready for me to comment on that. Sorry, did you say that there are two groups that are meeting there? You said that there is one group that had met for the first time in March, which I take as March 2022, and there is another meeting that is due to take place for the first meeting in June 2022. Are those two different groups looking at it? There is the ministerial and cosla group, so Councillor McGregor and Kate Forbes, the Cabinet Secretary for Finance and Economy, chair that. There is an official level group that is producing the material that would flow into that ministerial group. That official level group replaces a previous group, which is probably a bit more amorphous in terms of its functions and responsibilities and perhaps led to the comments in the 2019 Audit Scotland report. It has a clearer and more direct remit with responsibility for co-ordination and securing delivery of the strategy. You are quite happy that you have taken on board all the comments from the 2019 report? I thought that they were on point and that they were helpful. Our objective is to deliver good quality public services and value for money, and things that enable us to do that are good news. We have now got some questions on Government Assurance and oversight of major ICT projects. I am going to bring in Willie Coffey, who is also joining us this morning through video link. I am hoping to ask a couple of questions relating to the technical assurance framework in progress. Colleagues, you are going to recall that some of the key reasons that ICT projects failed in the past was a number of factors. Project planning, probably the application or the lack of application of quality management processes, skills identification, skills problems in the mix were always a problem too. The number of issues that the committee fell over the years gave rise to projects running over time and over budget. Perhaps the I6 project was a particularly bad example of all that. We could see from our perspective that things tended to be rushed from the start, poorly defined, too many changes along the way, all of which led to these overruns. In fact, the I6, as I recall, was abandoned altogether, so I wonder what Jeff, and maybe Johnny as well, could give us a bit of an overview of what we are now with all those types of issues and whether we have captured those particular problems and the processes that we embrace in the various frameworks that we have are working in place for successful delivery. That is quite a big question. I will take and pick off some elements of it. I will maybe invite Sharon to come in and talk about the assurance process that has been put in place and how that has changed. If we go over the reports from the committee and from all of Scotland, we can identify over the years that a number of things have not gone the way in which we might have expected and the items that you identify, poor planning and unrealistic expectations around time, absence of capability—those are all elements that we are now familiar with. In terms of the work that we are doing across SGA and the wider public bodies, we are focused on addressing a number of those areas. If you take the area of capability and the availability of digital skills and digital professionals within the delivery pipeline, there are a number of things that we are doing there to increase that resource and that strength, but to help colleagues who might not be digital colleagues to understand where those professional skills fit in in the same way that we use accountants and lawyers and economists and statisticians—those are particular skills. Growing that capability across Government and then using it wisely is a key component of the work. In terms of the forecasting and finance, it is generally a lot easier to look back at the end of a programme and understand how it ran rather than to know how it is going to run. One of the challenges that we face is that we could invest a lot and more time and money up front trying to work through every scenario and plan for every eventuality, but there is a question as to where the proportionality is, whether we might end up spending more money and taking longer to do something by trying to close off all risks. The model whereby we apply good planning through the business case model using the finance manual, using the learning that we have from previous programmes, but building in contingency and expecting things to run exactly as we predict, understanding that there may be challenges with partner bodies, that there may be what we might describe as gotchas along the way where something appears and surprises us in terms of the delivery of a programme. Within that, for those areas where there may be less uncertainty, building in the expectation that time may move and budgets may move. Applying the idea of contingency, addressing overconfidence in a careful and sensible way, there will be some things that we know how much they cost and how long they take for any project, but there will be other elements of it that we will only really know once we get into the process. Part of that is also the strong emphasis on design and working with end users of products in that you can only really do that during the process of delivery. You cannot do that ahead of the delivery process. Each of those areas we are building on the learning. I think that you can be assured that we pay a lot of attention to both the committee's reports and Audit Scotland's reports. They are the things that keep people like myself awake at night in respect of individual programmes and projects that we are responsible for, the concern that we might not know all that we need to know. That iterative process of learning from previous successes and failures is important. There is another element to touch on as well. We do relatively few different things through technology. We pay people, we record information, we make assessments, we share, we notify people, we inform people, but we then tailor those to particular services, whether that is in social security, education or injustice. The key element of that is that we need to increase any standardised processes and technologies that we are using to do those different things. Covid showed us that, with things like the Covid status app, we could move very quickly where we used a series of off-the-shelf components that we already had. The challenge became assembly of those components and testing and user testing to deliver them in practice. With that, we could have both confidence of the robustness of the technology quickly, but we could also take it from a request to delivery in three to four months without an extensive business planning process, without 16 gateway reviews. However, that approach of thinking of being smarter about how we use existing technology and infrastructure is key to the next five years of public sector technology. Sharon, do you want to say a bit about the assurance process? Yes, certainly. I think now that the technology assurance framework has become well-established. We now have over 500 projects on our register, so the process that we do of going out to the public bodies every six months to get information is now a well-practised process and the bodies are now becoming much more forthcoming with information at an earlier stage around projects that they are considering, which is giving us the opportunity to get in there much earlier to help to support them as they develop their plans around projects, and that is a good thing. When we look at the statistics for the reviews that we undertake both for major projects and around digital Scotland standards, we find that of the reviews, if I look at the statistics for the last five years, maybe only about 30 per cent of reviews give a clear bill of health and allow the project to proceed to the next stage without requiring any remedial action, but that demonstrates that we are now getting at a much earlier stages of these projects and programmes to help keep these projects and programmes on track to be doing what they need to be doing at an earlier stage of the programme before they proceed to the next stage. I think that that is a very good sign that that is now happening and that the assurance framework is now well embedded. We will never—we have to take a risk-based approach to assurance because we do not have the resource to do assurance over every single project that is being undertaken. We are not going to catch everything all of the time. There will still be issues that will arise for a whole variety of different reasons, but I think that we are seeing that we are able to get in there early and we are picking more things up at an earlier stage. We are continuously updating our review processes. We updated our major reviews process just recently to working with procurement colleagues, with cyber colleagues, with digital colleagues, with finance colleagues so that we are continuously picking up on the lessons that we are learning as we do this and feeding that back into our review processes. Okay, thank you. Willie Coffey has had to switch for technical reasons to audio only, but I am going to go back to Willie Coffey, because I think that he has got further questions that he wants to put. Thank you very much. You know that would happen during the discussion about ICP. But good answers and lengthy detailed answers there, which I really appreciate and I heard them very clearly. Is it picking out any projects individually? I think that my colleague, Greg Hoy, might pick out a few key projects. In general, if you talked about the benefits of good design, clearly, if you have good design and a key specification for a piece of software in with a good chance of delivering the thing on time and on budget, are you able to give the committee an assures that, from all the range of projects that are in there, I think that more than 500 are in there that are currently being worked on, are we in that good place where we think we know we have good design, good specifications, good skills mix in the projects that are good enough to deliver those projects that we are working on, on time, on budget? Would you finally say that all of the projects that we have currently got on our books are well defined and capable of being delivered on time and on budget? That is quite a broad question. I will begin by saying that I have not reviewed 500 projects and so I can only speak to those that I have got direct knowledge of and which I have seen. I would reflect on some of the challenges that we see with individual projects. We see the challenge of changing requirements. As time moves on, people think differently about the objective that they are looking to secure and that requires good programme management to understand the degree to which those are reasonable adjustments to make or you need to hold to the original requirements. As the committee has previously reflected on, we are also challenged in terms of the skills and capability, although we are doing good work to address that and hopefully at some point during the session we will get to talk about that. The design process is one that has been growing across the public sector over the last three to four years. As part of that, we move from the idea of doing technology projects or ICT projects to the idea that digital is one of the tools that we use when we try and reform public services. While often we are talking in terms of the technology component of a public service reform being where a lot of the challenge resides, digital is a means by which we are better able to serve the public and so needs to be woven in with changes to how our workforce functions, how we interact with what public expectations are. That is why I am cautious of overly attributing the change process purely to ICT or the digital component of a change process. In many areas, in areas of reform that we are looking at at the moment such as education, we have changes to organisations, to the legal framework, to the expectations of the delivery mechanisms and also changing cultural expectations as well. Within that, the digital component is one element. I would say that we are probably in a better state than we were in two or three years ago, but this is an area where we need to continue to make improvement. I do not think that I would be satisfied to say that I am content that everything is fine, because I think that that is the substance of the question. I am at all happy to say that there will continue to be work that we can do to improve the quality and robustness of the work that we do. Just finally, Jeff, would you give us an assurance or any kind of assurance that we are not likely to see another ICT? Is that anything? I guess that is the point at which you look at your likely retirement date. Is there a likely to be one? I can give an assurance that the process that we have in place are designed such that, should we have good actors and appropriate attention across the system in 100 plus organisations, it makes it less likely that we would have such an event. But again, if you are asking for a cast-down guarantee that it won't, I think that I would be reluctant to give that. Okay. Thanks very much for that, everyone. Thanks. Back to you, convener. I reflect on the fact that, at the moment, there are five major ICT projects that Police Scotland has got under way, so I hope that there isn't an I6 around the corner. Thank you, convener. Good morning, Mr Huggins. The 2019 report suggested that a single individual be made responsible to oversee Government ICT projects. I think that the Government has to come forward with that recommendation and said that it would consider it. You are the director of digital. Is that your role and, if it is not, can you give us some indication of where the Government's present thinking is in relation to the creation of that role? I think that it is an interesting proposition. I was reflective when I was rereading the 2019 report and also the report that the previous incarnation of this committee produced last March. Within accountability and how we understand those programmes of work, it comes back to my answer to Mr Coffey, which is that we do not see ICT as a thing that is separate from the delivery of good-quality public services in the same way that we do not have a single person across the Scottish Government who is responsible for the public sector workforce. The projects and the programmes of work, we do not like to see stand-alone ICT projects. We are looking for them to be woven into the business model of the public sector agency that is taking forward the delivery of particular services. For that reason, I think that it is entirely appropriate that accountability for individual programmes of work need to sit within the accountability structure for the wider responsibilities of such organisations, whether that is a health board or an organisation such as Forestry Scotland or an agency, because that requires the person who is the accountable officer within that organisation to be thinking about digital as part of his armory or her armory of how they take forward change. At the same time, the work that we did across the autumn in reflecting on our connective tissue, we identified the need to improve the work that we do in respect of what we might describe as horizontal functions. Those are functions that are common to each programme of work. Whether that is the capability to deliver, whether it is the cyber security wrapper, whether it is the process of protecting privacy and delivering GDPR. We think that there is a role that the digital directorate, alongside other directorates such as internal audit and assurance, has to do in raising standards generally to give accountable officers and SROs across the organisation a better chance of being successful in the delivery of their programme. The other element is mapping that across the different ecosystems that we operate with, so we do not have a single digital public sector ecosystem. At an abstract level, maybe we do, but once we take a step into an area like justice, the majority of nearly all of the functionality that has been delivered in digital is delivered by external public bodies, such as Police Scotland, the prison service and the court service. The challenges for those organisations to work effectively together to common objectives in respect of protection of the public and rehabilitation of offenders. Some of the ecosystems are closer into the Scottish Government, so if we think about agriculture and rural economy, the majority of the functions there actually sit within the Scottish Government or within its agencies, but looking for that ecosystem to be working effectively with a shared set of objectives. Again, with each of the organisations within those ecosystems having their own accountability, I think that there is a real risk that you should decide to allocate all of that accountability to yourself. First of all, I would be very busy and would probably never sleep, but also the degree to which it means that those people who are closest to the action would not be discharging their accountability functions in an appropriate way. Was that a long way of seeing that the Government has discounted that recommendation? It is too strong to say that we have discounted it. I think that we understand the intention behind it. We understand that it identifies the need for us to give clearer direction around a number of those horizontals and improve robustness. In some areas, it will take us to probably greater direction in terms of things such as architecture, but I do not think that the idea that we should be divesting accountable officers who are responsible for delivering services from the digital components of that service would be a wrong step. To go back to the recommendation, it was not necessary to make them accountable, but it was an oversight function. Do not you still think that there is a need for an oversight function with a clear line of accountability? The text of it identified it as being a single officer responsible. That feels quite strong. That feels like an accountability. In the context of accountability, my concern is that that begins to produce a confusion as to exactly who is responsible for the delivery. The allocation of the money that is being used to support those digital programmes is coming from allocations given to individual public bodies or agencies. It is not an allocation that I hold. The choices that are being made in terms of the programmes to take forward and be initiated do not sit with me. I guess that the challenge of being responsible for things that I do not control is a slightly worrying idea. As I said, I understand the importance of that. In terms of the mischief, the sense that there is not sufficient direction, control and orchestration, I agree with that. We are taking a number of steps through the digital committee and the horizontal work to address those challenges. I am so misfail whether I am just nodding an agreement. I assume that you are going to validate that position, but just from an audit and governance and accountability perspective, wouldn't it make sense to have a single figure within the Government to whom or on whose door you could knock if we had concerns about the way ICT projects were developing? I go direct at that point. A lot of the stuff that Geoff has said is that accountability for the delivery of public services sits with the accountable officers within the organisations responsible and that incorporates the digital element of the delivery of those services. They have their own assurance frameworks within each of those bodies, they have external and internal audit and they are accountable to Parliament for the delivery of those public services. It is right that the digital element of those services sits with them too. We work closely with Jess's team and the public bodies that we provide internal audit service over, but I would expect to be looking at the individual bodies and their accountability for their projects within those bodies first and foremost. Then we will work with the Scottish Government on, as Geoff puts it, the horizontal themes and the lessons learned and ensuring that all those structures and presses are in place to support as good a delivery as possible. The key point for me here is the point that Jess is making around the fact that IT is an enabler. It is very difficult to extract from some of the delivery of improving public services the IT element from all of the rest of it. It has all got to be part of the whole in order to deliver that change in service. I think that Mr Coffey referred to the major projects that are currently under way, which are critical to the delivery of the digital strategy. Are there any at this point in time that are giving you any further sleepless nights? The particular major projects that we refer to in the digital strategy are generally focused on the areas that we have described as common platforms. For me, that is the work on the use of applied infrastructure, the work on identity and the work on payments. Each of those sits within my responsibilities. As a consequence, they are more likely to keep me awake at night. The broader strategy talks about a number of different areas but does not have a particular focus on any particular major projects as they sit within other strategies, whether that is health and care or justice or education. In terms of the focus around the areas where digital directorate is in the lead and for which I am accountable, we have done some work since the summer of last year to reorganise and address how we deliver those programmes. In terms of payments, we made the first run of payments using the Scottish Government's payment platform in December, which is a key milestone for the delivery of a programme. We made a payment run for the independent living fund. We would expect that, by the time that we get into the summer, that that will be the mechanism by which payments for the independent living fund are made. That is a programme of work, which is clearly working its way through the process of MVP to Alpha to Beta and into live service. It is going to be quite an interesting change for us because, with the exception of some of the work that we do around publishing through myGov and the work there, this takes the Scottish Government into delivering a live technology service being supplied to more than one by the time we get to that stage. External public bodies will rely on it, so it takes my team into having to build a new set of skills in terms of the robustness and on-going management of technology. It brings us into commercial models. We are going through the process at the moment of effectively building a series of new skills and teams within the directorate to be able to accommodate that. Alongside that, we then have the work on identity. Identity is a key concept in terms of digital technology. The idea that I can demonstrate to a body that I am me and that I can use that identity to do things such as make a payment, access to service. It is a complex technology. The UK Government and other European nations are working on it. We are talking to colleagues from Denmark and Estonia who have also taken forward programmes of work in that area. Over the past four or five months, we have made significant progress in terms of that work in relation to the delivery of a single sign-on product, which is a first step. As we go into the second half of this year, we will be looking at attribute stores. There could be quite a lot of change to make the programme considerably more robust, a review also of the programme management and the programme governance for each of the projects. The third, I guess, on my list that I have mentioned is the work in respect of cloud services and cloud infrastructure. This is an enabler of an enabler. As we step into the next period of time, we would anticipate that most public services will run on cloud. They will not run on more traditional on-premise services. As part of that, what we have seen over the past couple of years is that each organisation, as they make that journey, is having to go out and build some of the core infrastructure, not directly, quite often, through third parties. The core infrastructure is pretty common. It is the sort of thing that, having done it once, you should use it many times. It also allows us to think about how we bring it within our cyber shield as well. If we are doing it in a common way and if we do it in a common way, it makes it more predictable, makes it less likely to fail. The programme of work is slightly more mixed than the other two, in that it is both developing the conceptual model for how we take that forward, but also some of the core infrastructure around client management, FinOps, because cloud is a service that you pay for on the basis of consumption, so how you architect particular technology will affect how much it costs to run. At different times, all of those programmes of work keep me awake at night, but at the same time, as of the end of March, I feel considerably more comfortable than I did in the summer of last year, just about the skills capability and work that is going on there. In terms of comfort, can you provide the committee with an update on how the social security software components are progressing? I think that it has been a really interesting programme of work. It is a major technology investment and transformation programme. It is currently in the first phase of the adult disability benefit payment, having launched the child disability payment at the end of last year. That takes them to effectively nine out of the 10 major benefits that they are looking to bring across. They have clearly learned and iterated and applied a lot of the design that we would expect to see, as well as building very modern infrastructure, which is the sort of infrastructure that we would expect to see. I sit on their programme board and meet with their senior technology leader on a regular basis, so I have good visibility of that programme. Again, that is probably a good example of how we work across the Scottish Government to build confidence in the work that is going on. However, it has been a major undertaking that has gone remarkably well and is a testament to all those who have been involved in the work. It is interesting because the capability that they have built over the past seven or eight years to build the system, and I think that I was on the programme board as far back as 2017, so having seen it at the start and seeing it now is just as interesting. That is a capability that will begin to become available to other programmes of work as they move into a business as usual model and move away from the very significant development phase that they have been going through. I am hoping that, by the time we get into 2024, they will be offering me technologists, service designers, user researchers that I can deploy across other programmes of work. If I can close just by looking at financial controls and prioritisation of spend, obviously, I think that the enabling digital government audit Scotland report highlighted that there is no complete picture of the number and cost of digital projects across the public sector. In response to the previous committee's report in March 2021, the Scottish Government said that it was about to implement a new spending controls process. Could you perhaps bring us up to date on that and where the Government's present thinking is in relation to IT prioritisation control and spend? The programme of work is a really interesting and quite challenging programme of work. I guess that there are two or three things to say at the beginning. First of all, we are being very careful to ensure that it is not simply another layer that replicates something that is happening through the digital assurance process, which we already have. It needs to add a different value as opposed to being a further process that people go through. We spent time over the autumn and into this year looking at the interaction between those different processes such that we can then explain how they cumulatively add value and how they are not duplication. We are doing that piece of work. We are also conscious again that applying a control through a process such as this, how that then also interacts with the accountable officer and senior responsible officer responsibilities. What that takes us to is an approach that is focused on identifying and highlighting and escalating risks into the accountability space to look for an appropriate response, mitigation or change of direction. However, it is within that process, but we are not looking to dilute the accountable officer responsibility. In terms of the practicalities, we have done quite an analysis of how we spend money on digital, which looks beyond. We might describe it as a sideways look, but by going through and tagging, it can be difficult to do accurately where money has gone on digital, whether that is on contingent staff, whether it is on consumables, whether it is on contracts and procurements, and to understand that. Instead of looking down the individual programmes, it is looking almost sideways into the budget. It has given us quite a set of interesting challenges in terms of whether an area struggles to recruit and then takes on contingent labour or contractor labour, the additional costs in that space, but then, if that is equally a challenge, the next stage is potentially to go to an external managed contract and then becomes a further cost. Those things tend to be not that visible within the process of looking at individual programmes of work in terms of understanding those dynamics. We are working through how we understand how money is used as part of the process. In terms of the practical application, we have agreed that we will pilot that. In the interests of fairness and transparency, we have decided to apply it to me first for reasons that eat your own dog food and take the learning. I was keen that we would experience exactly what it felt like to be subject to spend controls. We are looking at two or three programmes of work that sit on the internal technology of the Government. Some of the processes that we are doing around things such as telephony and the evolution of that over the next period of time. Effectively, to say, if we take the framework that has been developed and apply it, how does that operate in practice? In terms of applying spend control, it suggests that we have a knowledge of what we might expect to find in respect of a particular type of programme. The work that we are doing on component-based architecture and architectural principles, as well as capability and design, becomes relevant to spend control process. If we are making an assessment, it is not just an individual's view. I am a professional and I think that you should do it this way to have a consensus as to what you might expect to find for an individual programme. That is still developing work and with particular structures being put in place to create some of those effectively agreed frameworks for how we do things. I think that that is probably where I would say that we are at this stage. We are in a test period developing some of the artefacts that sit around it, but it is conscious of how it fits into the broader ecosystem of governance and control. One final question on a specific project. If I may, you mentioned earlier the Covid status app as an example of the agility of the Government IT process and the procurement process, I am assuming, as well. Just to interrogate that dynamic of how the spending control process works in practice, I think that the initial estimate for that project was something in the region of £600,000 and it ended up at £7 million, as my understanding from recent media coverage. How would the spending control process during a project like that work? I am not sure that it even counts that level of spend as a major ICT project, but just to understand how a project of that evolves and what spending control mechanisms are in place? I have not seen the financials. I think that in terms of the particular programme of work, and I guess that it is one of the components that goes into that programme. One of the key elements of it is the validation of identity. In respect of the programme of work itself, what we can see is that that particular process, by which, when you signed up for the app, which I am presuming that you did, you were validated. That involved the tying of your identity to a particular set of data on the vaccination database. That went through a process that, if I understand it correctly, requires a one-to-one matching of you with your data through the JUMIO product. That is a challenge that we have equally with identity. That effectively has a component cost. I am guessing that, based on markets, there will probably be somewhere between £1 and £2 to do that match, because there is a market. It is on the UK Government contract framework for those services. Each time that somebody signed up and 2.5 million people signed up for that, there would have been a cost of somewhere between £1 and £2 going into that. I guess that it probably was not contemplated at the beginning as being a component of the cost of the project. It is not a project that I have direct responsibility for. I guess that it shows how it is something that you have not anticipated that you will need to do. It becomes a cost. That presumably talks to the point that the control mechanisms need to be taken up. I think that that probably comes back to a design issue, but with fairness, the programme itself and the urgency with which the programme is being taken forward probably takes it into a slightly different box. I would say that, with my identity programme, which is going to require a similar type of service, if in two years' time you are asking me why did it cost three times as much and I say it is because I did not quite realise that I was going to have to pay for identity services. I think that I would look a bit daft because I have got the time to work through that and to budget for that appropriately. One of the reasons why this committee has had an interest down the years in major ICT projects is because there have been some fairly notorious cost overruns and failed applications, whether it is NHS 24 or the Scottish Public Pensions Agency, the CAP Futures programme and the already mentioned Police I6 project. I want to go back to what you were saying about the already existing structure of accountable officers. The committee has previously said that there needs to be a much firmer grip taken of that and much clearer lines of responsibility. If I take, as I understand it, Police Scotland. Police Scotland, when I read the list of ICT projects, has got, I think, five or six on at the moment, five anyway, unified communications and contact platform, digital evidence sharing capability, national integrated command and control system, co-operational solutions, mobile working, different projects. Who has got oversight of those? Those programmes will appear on our list and they will be subject to the assurance processes that are taken forward through gateway reviews. The accountability for those programmes sits with the accountable officers within Police Scotland and the SPA. That is appropriate because those are mechanisms by which they discharge their functions of delivering a police service. They are not an IT company, they are not a technology company, but they are required to build that into their process of delivering the service that they do. It sits with them. So what is different now to the position as was when the I6 project was under way? There are a number of things that are different and a number of things that are changing. First of all, we have got better knowledge of why things do not work and lessons are being applied and lessons have been learned. We have a greater attention to the capability but also to digital leadership within organisations. One of the key objectives that we have over the next 12 months is to increase the number of senior people across the public sector who are effectively digital professionals. To move it from being at a lower level within organisations with digital services being managed by generalists to increase the visibility of digital leaders in each of our organisations. That includes the Scottish Government. During this year, we will run a deputy director board to effectively establish a number of digital and technology professional deputy directors so that they can sit within other portfolios and bring that knowledge and understanding of programmes of work. Elevating that digital leadership component with the objectives that they are part of SMTs, senior management teams across the organisation. That knowledge, capability and leadership is core. Alongside that, we have things such as leading in a digital world, which is working with both people working in the digital space but with other leaders, which is the Scottish Digital Academy's work to increase knowledge and understanding of digital programmes of work. That extends beyond the design components and those elements into understanding governance and control and process and understanding what can go wrong and what has gone wrong. There are a number of things that are in place. I think that the bigger set of changes, though, are those work on horizontals, whether they are through better assurance, better compliance and understanding the implications of running services directly. Increasingly, we are digital organisations. If we go back 10, 15 years, we were not digital organisations. We maybe had third parties who did digital things for us, but now it makes no sense for us not to see ourselves effectively as a digital organisation. I think that we may have a session in the future where we drill a bit more deeply into some of these individual ICT projects. In the interests of time, apart from anything else, I am going to hand over to Colin Beattie, who has a number of questions to ask. Just building a little bit on what the convener has been talking about, over the past 11 years in this committee, I have seen a whole progression of ICT projects, which have failed or failed to deliver what was expected and, in some cases, were abandoned. We have heard from responsible and accountable officers in front of us here that there was an acceptance that the accountable officers did not have the skills to manage those projects and that, in the organisations, there was a lack of end-user understanding of how to interface with the technical experts that were building the programme. Again and again, that has created unwarranted optimism, followed by, of course, dismay when what is delivered does not comply with what they were looking for. The response over a period of years was for layers of management to be thrown in centrally, and at one point it was quite bewildering trying to understand which layer did what. I am assuming from what you are saying that has now resolved itself somewhat, but I do not understand where the change is. We have still got the accountable officers being accountable for the projects. The idea was that there would be a central capacity created to provide them with support, to help them to identify providers, to help them as end-users to gain the skills and so on that were necessary to ensure that those projects delivered what they were supposed to do. We received all those assurances. I am not clear from what you are saying whether all those assurances have actually been delivered and I would be interested in getting a little more information around that. There are a couple of elements there. The work that we have been doing through the digital transformation service is probably key to that. It is one of the divisions in my directorate that has a focus on how public sector agencies and public bodies work their way through the change process. It tends to be not the mega bodies, but the ones that are quite often well resourced and have available digital resources internally and externally. However, the digital transformation service is focused on delivering support in a number of ways. It hosts the digital commercial service, which is a joint piece of work between myself and the director of procurement, Nick Ford, in the Scottish Government. It looks at how we buy things and how we manage contracts effectively. In terms of assuring ourselves that we are buying things the way we should buy them with a sense of surety as to what we deliver, it hosts the design capability within the directorate, which is working through how organisations work through the user-sensor design process, but it also applies items such as accessibility and the elements that are core to what we do. Alongside the work of the platforms division, it is also working with the process of beginning to scope out the public sector architecture and the componentry. We have recently used the digital fellowship programme to bring in a senior chief architect. That will effectively operate as a sub-board to the digital committee. That is basically saying what a programme of work, how it should be architected, if it is to give a greater likelihood of success. Then we have the work on the profession and capability, which is taken forward by a separate division. In terms of the orchestration of those different elements, which go to giving a better chance and opportunity of a successful programme of work, that is part of the change that we have put in place and which we continue to take forward. Understanding that that effectively in itself is also a service, so understanding what other organisations need and what the best way to provide that to them is. The experience is that it is not simply running seminars, providing guidance and telling people what to do. Quite often that takes organisations and people to a particular point, but the next stage is the question of how we apply that knowledge within our context. That takes us to a process that is a bit closer and a bit more engaged in that. That functional capability from within the directorate is intended to address some of that, but, to be fair, it is more likely to apply to medium and smaller public bodies. The larger public bodies, such as the NHS or Police Scotland, are at a scale where they have their own digital departments and their own digital agencies within them, so it operates in different ways. Even those departments talk about the police and the NHS. They have their own digital people, but they still have projects that have failed and failed because the skills were not there to manage the contract. Even the contract negotiation has been an issue with some of those. How are we providing them the support on this? From what I can understand from what is being said, the individual accountable officers within whose areas those projects might fall would still have the final say in how that project is managed, or do you have the authority to overrule them if you feel that they are going adrift? A set of arrangements in place in respect of how we procure within the digital space and the procurement aspect of this is handled by the director of procurement using the frameworks that we have in place to purchase things and the processes that we apply through the procurement process. Those are robust. The area that we have then developed over the past 12 months is to increase the support in respect of contract management, because often things go wrong after you have procured to ensure that there are robust arrangements in place to manage people who have sold us things or are selling us things as an on-going service, to understand the tools and techniques and approaches and the documentation and the review that we would expect to see as part of good contract management. That is an area that has been strengthened through the creation of that additional function between, as I said, myself and the director of procurement. We have each of those elements. The challenge is that there are many reasons why a programme of work may fail. Often, those reasons are not current reasons, they are historic reasons. The model or the approach was never going to have success. The demand for the service that people thought was there maybe was not there, and that has been a common challenge across Governments across the world to build services that people simply do not use. The process of increasing the use of design, testing, MVP and piloting projects is part of the process of reducing the number of failures. Most of the projects that we have seen fail have failed not because of delivering something that the public did not want. They eventually delivered something that the department or the division concerned did not expect. It was a case of interpretation between the end users and the techies building the system, because that is vital that there is an understanding between the two. Yet, again and again, what is being delivered is less than is expected, different from what is expected and unable to be used for one reason or another. Out of all this, I would have expected a stronger central support. We talk about contracts. Each individual accountable officer surely does not have to be trained in the intricacies of a contract to build a new software system. Surely that is the sort of thing that could be centralised. You would have experts going through that and making sure that all the safeguards are there. We have seen systems built that had no safeguards in it all. There were no penalties on deliveries and all sorts of things that are basic. Surely that is the sort of thing that could be centralised usefully and helpfully. I think that the challenge is that once you begin to unpick the components of a programme and ascribe elements of that programme to a central function, the degree to which accountability becomes tangled. I guess maybe to take a step back and to think about why programmes succeed rather than fail. Mr Hoy asked about the Social Security Agency. The Social Security Scotland has in place very robust governance arrangements for their programme of work, which the accountable officer is directly involved in on a regular basis, with a clearly appointed SRO supported by technical capability to execute both in terms of the technology, the design and the business and commercial aspects. They will then also work with Nick Ford's colleagues in procurement in terms of understanding the wider dynamics. They will take some support, but within their programme of work, they are assuring themselves that the money that they are spending is being used wisely. It is that element of understanding the ingredients that you need to put together within the delivery of a major programme is the learning that is being applied through things such as gateway reviews, which look at the outset of the question. Are the resources here to give this a chance of successful execution in place? Earlier, you said that you were expecting technical expertise to reside within the different areas that the accountable officer would be able to access that to expertise internally in his area. Again and again, what has come to light is that there is not enough technical expertise in the market. There is a huge shortage in Scotland, not alone in that. The last estimate that I saw, which was several years ago, was 300,000 short across Europe. It is big numbers. Those that are available are demanding salaries, which are way above the normal scales. They were being paid off scale at one point to try and get them in. Is it realistic to expect that each area is going to be able to recruit at some considerable expense this sort of scale to enable them to build a contract? Or would it not make more sense for it to be available centrally to give that support in a rather more cohesive way? It is interesting that we came to that conclusion last year in respect of recruitment of digital professionals. On the basis of that, we developed a proposition under which we would create a separate digital recruitment function sitting between myself and people directorate within the Scottish Government, focused purely on bringing technical expertise into the Scottish Government but, over time, the wider public sector, understanding the dynamics of that market. Digital professionals have skills that enable them to work where they wish and to work on the projects that they want to work on. As a consequence of that, they tend to move more frequently. Our model of the person who joins Government for life does not apply to digital professionals. We need a way of thinking within that under which we are continually recruiting. Even if we do not have a vacancy for a programme delivery manager in digital, we should be recruiting for those, because we know that in six weeks' time we will need one. We have agreement to put in place a new service that will launch during this year, which will focus and use the techniques that are being used externally by private sector agencies to recruit digital talent, which understands how people in that space apply and how they expect to interact with the recruitment process. They do not expect a traditional governmental approach. I recall recruiting in the NHS a couple of years ago, and somebody wrote on their application forum, I will tell you an interview for each of the questions, which declined to enumerate any of their competencies or skills. We had to work with candidates who we thought were credible to enable them to apply so that we could assess them fairly. We needed to, to some degree, bring them into our world, so we will have a new process of bringing that skill into Government. In terms of values and salaries, we are doing some work at the moment on that in the context of the review of the data analysis. What that shows is that we are not uncompetitive, and there is a real risk that Government, as it accelerates and puts more money into the digital area, begins to distort the market simply because of the demand. Effectively, if we do that, we push up the cost of all programmes of work. However, our salaries are not uncompetitive for most roles, although we will struggle to pick up particular skillsets in the areas of things such as cyber, where those are like gold dust across the system. Understanding the process by which we recruit in terms of the dynamics of those who are looking to bring in into the sector, my experience is also that there are many from the private sector who would very happily come and join the public sector. They are people who are motivated by interesting things to do. Some may be motivated by money. We probably do not want them, but the chance to build a new social security system, to assist with helping Ukrainian refugees to come to Scotland, to addressing things such as a national care service, are the really exciting programmes and projects of our age. Although some may be excited by selling holidays or social media or things like that, the opportunities to change the world will be involved in that process. We have not sold ourselves that way. We have a number of measures in place that are particularly designed at increasing the capability. That is one area where we see value, because in the absence of that, each different area is competing with each other in a different area for the same talent. Looking back at previous ICT projects that have failed, almost invariably, where an NDPB is involved, we have an IT failure. That is what we have seen historically. How do you provide the myth support? How do you ensure that they are not just going off on their own and creating rubbish? In some cases, that is what has happened in the past. Can I bring in Sharon Fairweather at this point? I think that you have been meaning to get in. Oh, sorry. It is not that I do not like listening to Jeff, because he is a relation person to talk to. We are getting tight for time now. So there are a couple of things. First of all, we obviously talk to every NDPB on a six-monthly basis about the projects, and they come on to our project registers. We know from an early stage the projects that they are involved in, and we then get involved with them right from that start and do the risk assessment around the level of assurance that they need on those projects. A couple of points that I wanted to make. Within the technology assurance framework that has developed in recent years, some of it has a consequence of things like cap futures programmes, et cetera. Some of the programmes that you were talking about that have failed, we have put in significant new assurance structures since then and have continuously developed them further from the lessons that we have learnt from those types of programmes. I think that we have to bear in mind some of that historical timeline of some of the projects that you have been mentioning. In the period that the technology assurance framework has been running, we have done over 300 reviews on major projects on digital standards. That is not 300 projects because some projects have more than one review, but because we have been doing it at various stages, we have been able to catch, as we have said earlier, issues earlier in those projects. There have not been 300 or 150 or even 50 projects that have failed through that that have come forward. There have been some significant projects that have failed that have come forward, but I think that we are seeing more and more that the lessons from those project failures are being built into the assurance frameworks and are being caught earlier within projects now. We have said earlier that we cannot give you assurance that there will not be another project failure. None of us can do that, but I think that we are seeing a continuous improvement in the way that projects are being delivered. We know some of the areas, like you said, that we need to look out for. Capability and capacity of digital resources is one of them that we see often, but I think that we are beginning to catch some of that at an earlier stage. Just one other thing that I wanted to say, Mr Beattie, was that within the technology assurance framework we do have the option to stop a project. If we think that it is going seriously off the scales, we do have the option to stop a project, so that is in place, if it is needed. I thank the morning's witnesses for their evidence. There are some things that I think that we will probably be keen to pursue and, as I mentioned earlier on, I think that we are hoping to have a session probably with the accountable officers over some particular projects that have exercised our interests. I thank Jeff Huggins, Johnny Ruff, Sharon Fairweather and Donald MacGilvery for coming along and presenting yourselves before us this morning. It is appreciated. I will now draw this meeting into a suspension while we change over witnesses. I will resume this morning's meeting and turn to the next item on our agenda, which is a look at the briefing that was produced by Audit Scotland recently on drug and alcohol services, which was an update report on some work that Audit Scotland has looked at over a decade or more. We are joined this morning in the committee room by Stephen Boyle, the Auditor General. Welcome. Anthony Clark, who is the interim director of performance audit and best value, and by Gillian Matthew, who is a senior manager at Audit Scotland. What I would like to do in this session, Auditor General, is to invite you to make an opening statement and then we will ask a series of questions that we have on the briefing. Many thanks, convener. Good morning, everybody. Convener, today I am bringing to the committee a briefing on drug and alcohol services. Our paper updates our earlier work, as you note, from 2009 and 2019. Three years ago, we highlighted that drug and alcohol related deaths and associated ill health remained high in Scotland. Problem drug and alcohol use is closely linked to deprivation and ministers have described Scotland's drug deaths as an emergency, with the country having the highest drug related death rate in Europe. The number of people dying from alcohol has also been increasing, and excess alcohol consumption similarly causes wider societal and health harms. My joint briefing with the Accounts Commission provides a further update on the key challenges and areas for improvement, which we plan to follow up in more detail next year. Progress in addressing the challenges has been slow since our 2009 report, but we have seen the Scottish Government and its partners increase their focus and efforts in recent years. We highlight a number of new developments, such as the drug death task force, new medication assists the treatment standards and efforts to improve access to residential rehabilitation. This has been accompanied by a significant increase in funding in the past two years after a period of reduced funding and no real terms increase. However, it is not yet clear what impact those new approaches and increased investment are having. Our paper also highlights that the delivery of drug and alcohol services is complex. With clearer accountability needed, there are many organisations working across different sectors, and governance is complicated and difficult to navigate. More focus is therefore needed on prevention and tackling inequalities. Spending could be more effectively targeted at interventions, tackling the root cause of drug addiction in communities, but the Scottish Government has not yet identified what level of investment is required to achieve the greatest benefits. We are calling on the Scottish Government to join up the various strands of work and funding streams to show how it is collectively targeting improved outcomes. The Government now needs an overarching plan that clearly likes spending to reducing the tragic loss of life. In the longer term, more focus is needed on policies that tackle inequalities and the root of drug and alcohol misuse. As ever, convener, between Anthony Dillian and myself, we will look to answer the committee's questions this morning. Thank you very much indeed for that opening statement. The very first lines of the briefing are a stark reminder of the situation that we find ourselves in. The very first sentence in the briefing is that Scotland's 1,339 people died from drug-related causes in 2020, the highest ever reported and the highest rate in Europe. As you have just said in your opening remarks, progress, as you view it, has been slow. In this report, you once again describe a lack of drive and leadership by the Scottish Government. To what extent can you tell us, did the Scottish Government respond to the very clear recommendations that you made over a decade ago in 2009? Thank you, convener. I will bring colleagues in to support some of the detail in the 2009 report, but what we look to do in today's briefing paper is really to update on both the 2009 and the 2019 report and to signal our intention to undertake further work. In an area of real significance, the ministers have been very clear in their assessment that this is a national emergency, some of the statistics which underpin real-life circumstances, individuals, families and communities, and some of the very stark numbers before us. In terms of tracking the progress over the years, we note in the report that the arrangements that Scotland has to deliver drugs and alcohol services remain complex and fragmented. Some of the governance arrangements are also difficult to navigate. It is not clear what the most targeted successful funding delivers in terms of improved outcomes. There have been many initiatives that have taken place. We have gone back to the alcohol and drug partnerships that date around the time of the publication of our report, as a means of delivering more local targeted strategies. It is similarly not clear what the overall benefit that such structures are delivering across Scotland is. Twelve years, thirteen years or rather later, we are still as a country facing some really dreadful statistics in terms of the delivery of outcomes for problem, drug and alcohol usage. That is why we have arrived at the point today in spite of recognising the progress that has taken place in recent years, with additional significant funding commitments planned over the life of this parliamentary term. The call for an overarching plan that sets out what is the most successful interventions, what is evidence that supports those that lead to better outcomes, and that that plan is clear, transparent, measurable, and the governance and arrangements that take place across the country support the delivery of improved services. Can we have a little pause for a moment? I should maybe invite Gillian and perhaps Anthony also just to say a bit more about the trajectory of the past 12 years, if they wish. As the writer general says, in his opening statement, the progress has been slow, but we have seen a lot more developments and progression over the past couple of years. However, as we are saying in the briefing, it is still a bit early to tell the impact that some of those new initiatives have had. However, on some of the data and information systems, as we are saying in other reports as well, there are still gaps around that. We have seen delays in the drug and alcohol information system, known as DAISY. There have been quite significant delays around that, which has been designed to help ADPs in the alcohol and drug partnerships in local areas to see how they are managing people with drug and alcohol use and measure progress and look at activity. There are still quite a few gaps around the information that is needed to do that. We know that they are currently working on trying to improve information on rehabilitation services, which is a priority area for the Scottish Government. Along with that, as we have seen, the investment in drug and alcohol services reduced around 2016-17, and we did not really see any cash increase, but not a real-terms increase really until 2021. There has been much more significant investment, but again, that is relatively recently. However, we still do not know how that has been directed, not fully. As we say, we need more information on the details around the spending. We have not been able to track that fully. How much of that is directed towards prevention and the different strands of funding? How are they helping to improve outcomes and deliver some of the priorities that the Government has set? We still do not have a clear picture of how all that links together. We have further questions about the transparency of spending and governance arrangements and the strategy to come. I have one other question that I wanted to put to you. When I look at Exhibit 1 in the briefing, it describes how over time alcohol-related deaths reduced and leveled off over a period of 15 years, but then started to rise again. In your opinion, what are the measures that drove down that decline in alcohol-related deaths and what, in your assessment, may be the cause of the recent increase? To be clear, I am not sure that we are necessarily able to attribute with any great confidence the factors behind the movements that you identify in Exhibit 1 in respect of alcohol-related deaths. However, there are many complex factors behind usage of alcohol, and we know that there have been policy interventions, particularly as we touch on in the briefing paper on the introduction of minimum unit pricing for alcohol. What we are not doing in that paper is drawing that direct explanation into why the alcohol-related deaths have dropped as such. It is our intention to track Government's analysis and review public health Scotland's role in doing so and undertake further work. We also speculate, if I may say, in the briefing paper about the impact that the pandemic has had and the potential implications of increased alcohol usage over the course of the past two years, as ever. That would just be that, convener, speculation. We know that there are many various factors, but it is our intention to follow up further work, but we are probably restricting our ability to be definitive of what we think are the root causes behind that number. We understand that, and I think that that would be helpful to return to that. I guess that one of the overarching questions that come out of the briefing and that many people looking at this whole area of public policy ask is that, although there are new initiatives taking place now, why has it taken so long, given that you were evaluating this all those years ago back in 2009, during which time things have not got better and have got worse? That is certainly one of our conclusions in the briefing paper, convener. Progress has been slow. The reasons behind that—I think that our exploration of it should the committee so wish to do—are valid with Government and their partners as to why progress did not move on as anticipated. What we look to do is identify some of the reasons behind why progress has not been so. We are still identifying, as I have touched on, some of the governance arrangements feeling complex, a lack of clear transparency around some of the funding environment with which drugs and alcohol services are delivered, but also the reduction in funding that we know in the paper too that funding dropped from 2016-17 onwards. As Gillian mentions, it has returned to those anticipated growth levels and cash terms, and the Government has very significant plans over the life of this parliamentary term and some of the emergency interventions and more longer-term plan recovery arrangements and some of the rehabilitation services that they are supporting. What we effectively say is too early yet to tell how significant and beneficial those interventions will be, but it is vitally important that the Government has an evidence base with which to make informed policy decisions in the future. We are keen not to prepare another report like we have done in recent years, convener, that talks about slow progress, and we are keen to see that some of the interventions, the value for money behind some of those really critical steps, are taking. I am going to invite Craig Hoy to ask a series of questions. One of the key measures and policies taken by the Scottish Government has been the introduction of new medication-assisted treatment standards, which has become a bit of a buzzword. Your briefing rightly notes that those standards are aiming to give people access, choice and support through drug services. They are due to be embedded across the country by April 2022, which as we know is this week. I wonder whether you can provide some update on where you believe that to be and how realistic is the deadline of April 2022. I am going to turn to Gillian to update the committee on that point. As far as we know, that is on track. We were liaison with the Government around the report and some of the key findings, so that was confirmed to be on track. In terms of looking at one of the other key innovations and developments, it was the creation of a drug death task force in Scotland. The original task force, both the chair and the deputy chair, both resigned citing serious concerns that the pace that the task force was being asked to operate at would risk the implementation of sustainable change. Effectively, they were saying that speed does not equate to effectiveness. Do you share those concerns? After a period of inactivity, perhaps we are mistaking activity with making progress? We know the circumstances of the resignation of the chair and deputy chair in the briefing paper and the subsequent appointment of a new chair and deputy chair. I think that there are a number of related points in our own paper, so we do talk about the slow progress in our own paper. The need for an overarching clear, transparent plan measurable sets out the impact of different levels of investment. As we touched on already this morning, the very significant planned increase in Government funding. As ever, Mr Hoy, in this paper, as we do in many of our reports, we talk about the lack of high-quality data with which to measure progress. All of those things need to be in place so that, as we move into the life of this parliamentary term, what feels like a step change in plan and focus around drugs and alcohol is delivered to the best effect. I recognise the conflict between pace and the need to have a clear, measurable and deliverable plan. We look forward to seeing, in effect of our own recommendation, that a new overarching plan captures not just the work of the drug deaths task force but also the earlier strategy for rights, respect and recovery and the national mission that they are all gathered up on a measurable, clear and deliverable plan. Matthew Sultie pre-empty mewn relation to the considerable delays in the implementation of the drug and alcohol information system at DAISY and that database. There are still considerable data gaps within the system. Could you perhaps give some elaboration on the work that is currently under way to address those gaps and what sort of timescale are we operating to in order to try and make sure that we get this important information into the system? We did speak to some of the team at Public Health Scotland that are working on this. It is clear that there is still a lot of work to do. Some of that is related to the quality and availability of data coming from the ADPs themselves. I think that, locally, there is work being done around that. At the national level, there are developments around the data that is required. I think that some of that is still being worked through, reflecting some of the more recent initiatives that have been announced, the national mission. I think that the original plan for DAISY has evolved over time and you will have to take into account some of those new strategies and make sure that the data is there to answer some of the questions around that or to measure performance and progression. One main area that there is a focus on at the moment is residential rehabilitation services. There have been some recent reports on that. There is still a lot of work to do around the activity, the pathways, how many places and all that to build up the full picture around what is available and the Government is looking at increasing capacity. There is quite a bit of work to be done around that and other pieces of work. That was the main area that they talked about, but they did recognise that there are still gaps in other areas. We talked about homelessness people being very vulnerable, but things like some of those wider services are not all quite joined up yet. There is a recognition that there are still quite a few gaps and that there will be an incremental approach to building all that into the system, but because there have already been so many delays, it is still trying to get that in place and, as I say, the quality of data from the local partnerships. Finally, your 2019 update referred to the appropriateness of a 21-day waiting time target for drug and alcohol treatment. You also raised some serious concerns about do not attend people who effectively fall out of the system, particularly in relation to drug deaths, people who have had no contact whatsoever with the treatment. Are you aware of any work currently being undertaken or any ongoing work within the Scottish Government to try to address those two critical issues? I will turn to Gillian again if she has an update on the Government's plans around those points. For completeness, you are absolutely right that we noted in the 2019 report that the extent to which the 21-day target was appropriate, given some of the urgency of the circumstances that drug users might be facing, their ability to engage in services, as well as key emergency points in their lives. All of that was the root of our recommendation to take stock as to whether those measures were productive and were helping what felt like a really acute circumstance. However, I will check with the team for any more information on that, if we do not think that we can like and raise it. I will quickly comment on a broader point, which is that the issue around the 21-day waiting target speaks to a broader issue about capacity in the system. It seems to me that the issue there was people having too long to wait to access services at the need at a time of crisis, and the investments and commitments that are being made at the moment around building capacity are hopefully seeking to address that. One would assume that, as part of those developments, one would think about the appropriateness of the length of time one has to wait to access services. I am not sure whether that discussion is taking place within Government, but you may be able to answer that one. On the DNA point, it is very clear, I think, from what we hear from ADPs, that there is still a challenge around people falling out of contact with the system. That seems, I think, to speak to the cultural issue around the need to engage and commit and work with people when they are going through difficult circumstances in their life. It is why the whole issue of fairness and respect has been quite an important part of the conversation around changing the culture around drug and alcohol support for individuals. On the DNA point, that is another area where there is not regular data collection or reporting. I think that when we looked at that last time, there has been a one-off exercise to try and assess what that looks like. The Government has announced a new target, which I think is due to come into place in April, sometime from tomorrow, at looking at the percentage of people who are in treatment. The current target, as others have said, is an issue around urgency. Three weeks can be far too long for someone in crisis and needing treatment. The MAT standards are obviously focused on trying to address that, but the new treatment target is looking at the number of people in treatment and how long they stay in, because the other point is retention and remaining in treatment and people not dropping out of the service if they are not getting the right support. Would you say that there is a fear, much in the same way with rejected referrals within the CAM system, that the data that we have before us, even if it was accurate and properly captured, does not necessarily represent the true scale of the problem of people falling out of the system and we no longer have any further data for them? Is that a legitimate concern? Yes, I think that that data just is not there at the moment. Right, thank you very much indeed. Data gaps is something that we are quite concerned about, I have to say. I am going to invite Colin Beattie, who has a number of questions to put. Everyone is very concerned about that. It is a big issue for Scotland and it is something that we have to tackle. Is there any comfort to take from the fact that fewer young Scots are using drugs and alcohol? I realise that on the older side there has been an increase, but is there some comfort to take from at the bottom end where people are getting into the drugs and alcohol for the first time that that is reducing? Also, the first nine months of 2020 versus 2021, where there has been a 4 per cent drop in deaths, is it too soon to think that that is a trend or that it is resulting from some of the initiatives that have taken place? Yes, Mr Beattie. In terms of identifying the trend in the recent data, it probably is too early to be definitive on that point. What we have looked to do in the exhibit is to try and draw on some of the longer term averages to smooth out some of the impact of initiatives. Even as I touched on in the last question, data gaps can take a bit of time, so there is a difference between, as we report on in the paper, some of the national records of Scotland data and that from police Scotland's estimates as well. There is an overall issue about robustness of data that probably makes me hesitant in identifying any definitive patterns at this stage. I guess that your overall question talks about is there cause for optimism in terms of some of the choices that different groups in society younger people will make. Again, I am reluctant to be definitive and I think that it probably speaks to the overall point that we make in the report that Government and their partners will want to be absolutely clear about what interventions are making the difference, whether it is education and training for Scotland's young people, whether it is some of the emergency interventions, such as Naloxone, providing that to police officers, other emergency services and others, to prevent death from overdose at the point of crisis, or whether it is some of the more rehabilitation services that feature prominently in the Government's 100 million pound investment. All of those will want to be tested, evaluated and gathered together for the work of the drug deaths task force, the national mission and the strategy, so that they can be satisfied and clear as to what is making a difference, what is not, and do that in a really transparent way. As ever, I am being hesitant, as you can tell, as debated to be definitive about, to say that there is cause for optimism. The only one point that I would make is that, and we note in the report, is that we are clear that there is much more focus from Government and their partners in recent years than there perhaps was in the previous three or four years. We are going on to something slightly different. You have already mentioned about the funding. Sorry, did somebody else want to come in? Your specific question is about younger people. The figures that I have got to hand at the moment are for drug deaths, not overall drug use, but there has been an increase across all age groups in drug-related deaths, including the younger age groups, but the largest increase has been seen at 35, 44 and 45 to 54-year-olds. We can send links, but the national records of Scotland annual report on drug-related deaths shows the trends, and there has been upward trends in all age groups over the last few years on drug-related deaths. The figures that we include in the briefing are around the suspected drug deaths, which have come from police figures. As we point out, there is an issue with a lag in time lag in data. This is newer figures that have been introduced to try to get more timely data, and there has been further data published since our briefing on the suspected deaths for the period ending October to December 2021. There is now two full calendar years, so that is showing 116 fewer suspected drug deaths in the calendar year of 2021, compared with 2020. It is a slightly different source. The actual figures are slightly different from the national NRS reports, but they mirror quite closely. I think that because they are new, they are still looking to see how well they are given indication, but they are used more than indication of what things are looking like. However, the quarterly trends throughout 2021 have been reducing. It will be interesting to see when the NRS report comes out this year, which will be due in July, with annual figures from death certificates. Will that mirror the police-aspected deaths and come down for the first time, but we will not know that until summer? I certainly hope that it is looking a bit better. I want to draw out the point in the briefing paper on the importance of prevention, because prevention is better than cure. Your question hints that we can turn the tap off and stop people from getting involved in risky and dangerous and unhealthy drug and alcohol-related behaviours. The briefing paper is very clear that there is still a long way to go in terms of getting services collectively and the national drive towards that shift towards prevention. Coming back to what was mentioned previously about funding arrangements, in your report, you say that they are complex and fragmented. That was the 2009 report, sorry, and it seems to be unchanged in your latest briefing. What do you think the impact on delivery of services has been or is because of those funding arrangements? How can the Scottish Government make improvements in that area? As well as funding, it is a question of partnership and delivery arrangements, as well. I am keen to bring Anthony in to say a bit more about how the overall structures work is. What is clear is that you mentioned complex and fragmented. I do not think that we are differing our judgment in the briefing paper from the conclusions that we reached in earlier reports that there are many partners involved in the delivery of services across the 31 alcohol and drug partnerships that we have in Scotland, councils, health boards, police and third sector organisations, all of which are responsible for preparation of local commissioning and strategies. There are plans for change, Mr Beattie, as you know, through what may come from the national care service, which indicates that alcohol and drug services will be included in its remit. There are opportunities for the Government of the Parliament to scrutinise and to decide on if there is going to be more structural, fundamental change. Much like the discussion that we had on social care, there is an opportunity for change through the national care service. There is also an urgency with the structures that we have and the arrangements that we have at the moment that we would not want to wait five years for that to happen to see the level of change given some of the urgency in the numbers that we are capturing in today's briefing paper. However, if I may, I am keen to bring Anthony in, if you are content, just to say a bit more. Before Anthony comes in, is it then inevitable that, given the complexity of the diversity of the stakeholders involved, funding would be fragmented and how can that be improved? Obviously, complex and fragmented is not a good thing when you are trying to put together a strategy. Is it inevitable that the present system has to change? If I might turn to that question after I have done a brief overview of the nature of the complexity of the arrangements, if that is okay, Mr Beattie, we all know that people who experience difficulty with drug and alcohol services can lead to many problems in their lives, can't they? Problems with housing, employment, family circumstances and so on and so forth. It is quite proper that we have a range of different partners focusing on the needs and trying to support individuals. The partnership arrangements, as the Auditor General said earlier, have been around for quite some time, in various forms since the late 1980s. That is 25 or 30 years, isn't it? It is a long time. I do not think that anybody is arguing that partnership is not the way forward, but the reality is that, because the partnerships have to engage with integration joint boards, councils, health boards, police authorities and the third sector housing agencies, it can make it very difficult for the ADPs to influence and shape a range of different services. That is one of the reasons why what we have seen in our previous reports is progress towards addressing specific issues to do with drug and alcohol support, but much more limited progress in making that bigger change, which is making the shift towards prevention. There is an opportunity, as the Auditor General has said, in the thinking through around the national care service, to think about how we can get a greater focus on wider systems changes, while at the same time providing better, more high-quality, more impactful services, specifically for people with complex and severe drug, drug and alcohol problems. As to the question of funding, it is quite complicated, Mr Beattie. I am not sure that there is an easy answer to that. What is clear from our discussions with ADPs is that the plethora of different funding streams and the way in which the funding is allocated makes it difficult for ADPs to plan for the long-term. There might be some opportunities of thinking through how long-term funding could be allocated or whether there are ways of providing funding that gives ADPs a bit more flexibility and choice over how that funding is used. There will always be a need to have core funding through health, police and fire. I do not think that that would want me to take that away. The challenge, though, is how the ADPs engage with police, housing and others to get the services shifted and changed in ways that will work. The story is not unique to ADPs. It echoes some of the conversations that we have had with you before about community justice authorities. It echoes some of the conversations that your predecessor committees had about community planning partnerships. For us in Audit Scotland, there is a very interesting question around how to make partnership working more effective and more impactful. That is something that I think that we will want to consider as part of our long-term work programme. I hope that that was helpful from Mr Beattie. It is. Just carrying on from that, the next question that I was going to ask was about transparency, which you raised in paragraph 17. Is it inevitable that that transparency is quite difficult to exhibit when the funding is so fragmented and there are so many stakeholders? Is the solution to the complexity of the funding also the solution to the transparency, I guess, is in some way what I am saying? Jenny May might want to come in and add a bit more to this, and I see the Auditor General's mics on as well, so maybe I should defer to the Auditor General first. Really no need, but I will not decline the invitation. I guess there are a couple of things that I will touch on, and colleagues will undoubtedly elaborate, Mr Beattie, that maybe just focusing on the ADPs for a minute. The ADPs prepare annual reports and they are submitted to the Scottish Government, but there is not enough follow-through for a production of an overall report on how ADPs have functioned in Scotland. We think that that is a missing link. Even if we are not advocating structural change, so there has to be to bring further transparency, there are smaller things that could happen. If perhaps it speaks to some of the point that the committee has heard from us in other topics in recent weeks, there are many pots of funding in the delivery of public services. Some of it is delivered by Government, some of it is outside Government to partners, to other public bodies, third sector and beyond. What we do not have here is a clear picture of overall spending that is hard to pull together, but more importantly, what the outcomes and impact that spending has produced. I guess there is a question of transparency, yes, but also what is delivering the biggest benefit. Looking at the scale of the emergency that we are facing, that brings back to the urgency that Government and their partners really need to know with clarity what impact is delivering the biggest benefit from that level of public spending. I guess that overall transparency will help in our view to accelerate some of that thinking through and ultimately hopefully we will see as a real plan with deliverable and measurable outputs. I will certainly pause so that I am sure that colleagues will want to say more. I do not have much to add to what the other general said. Thank you very much, Mr Beady. I think just to emphasise the point around the funding, that was one of the part of your question around how fragmented that is, and yes it is, and there are different pots of money. What we found really difficult was to follow that through and see what the overall funding was. Even if there are lots of different pots of money, you should be able to see what the overall funding is. We did struggle to get a really clear picture of that. That was through liaison with the Scottish Government as well. I think that there are various announcements. Some of the funding is published, some of it is not. It is difficult to pull that all together and to follow it through. That is clearly where we are saying that there needs to be a lot more transparency around that. I will now turn to Willie Coffey, who is joining us through a video link. Willie is a video link and not solely an audio link, so we can see you too. Over to you for your questions. Thank you very much, convener, and good morning. I hope that the video link will survive the next five minutes or so. I wanted to ask a couple of questions on early intervention and prevention and maybe one on governance arrangements too. I have worked with a number of drug and alcohol projects over the years in my constituency. If there was one key ask by those people at risk, it was that they needed a flexible and quickly accessible service that they could call on to get help when they needed it. I think that there is good progress to report on that matter in my constituency. Do you recognise that as an issue that has popped up from your discussions and your analysis of that particular problem? How does that fit in with the work that the Scottish Government is trying to do in early intervention? It seems to be a huge issue for me and for the people in command on their own value. In fact, Stephen, what is leading to more suicides in relation to that matter is a serious issue. It is a big point that has been raised with me several times that direct and fast access to help and support services is crucial. Good morning, Mr Coffey. Thank you for the question. The themes that you are touching on are consistent with our reporting, not just in this briefing paper, but across many aspects of our work. That early targeted intervention leads to better outcomes from the delivery of public services and the experience that users get. It is of no surprise, through your constituency work, to hear that that is exactly what people who are using and relying on these acute public services are saying. It is not that there will be the only approach. I think that I understand absolutely Government's plans that it is a range of measures. Some emergency interventions mentioned the roll-out of the lock zone being one of the acute interventions that can take place on a necessary component of that. However, the early preventative work will be essential to delivering the level of change that Scotland needs. I think that it is fair to say that, through this briefing paper and some of our other work, we have drawn on and referenced back to Christie's commission report 10 plus years ago that focused absolutely on early intervention prevention as a way of delivering longer-term sustained improvement in public services. The regret is that those ambitions from Christie have not been realised and are still talking about the implementation gap from well-intentioned policies. Ultimately, that matters as to what comes next. Not just in drug and alcohol, as important and vital as it is, but the wider delivery of public services and the early interventions across many fronts will see the level of change in the quality of public services that we are all looking for. However, I absolutely agree with the premise of your question, Mr Coffey, that those early interventions and arrangements will make the longer-term difference to not just drug and alcohol services, but absolutely in the round. As important as drug and alcohol services are, many of the challenges are deep-seated across communities in Scotland that will require policy intervention across a number of fronts to deliver the level of change that we are looking for. You were saying also in your report, Stephen, that the Government has not been particularly clear on the level of spending that is being targeted at early intervention prevention. Could you just say a few words about that and what should it be doing to clarify or improve that aspect of it? You are quite right. Colleys can contribute as they wish. We do that in paragraph 18 to the report. We have effectively noted that the percentage of spending that is targeted on early interventions has not been clearly set out by the Government. I would probably reiterate the point that Gillian made a few minutes ago, that there needs to be absolute clarity in the planned spending, what feels like a fairly fragmented structure at the moment, with spending being delivered across many different organisations and complex governance and accountability set up. In our view, that hampers the clarity of what is making the difference in terms of early intervention and some of the more reactive spend. It speaks to the overall conclusion that we make in today's briefing paper of the need for an overarching plan with milestones that are reported annually against progress across the national mission, the rights, recovery, respect strategy and the work of the drug deaths task force. We are keen to see the Government reflect that in their updated plans so that we anticipate that they will be producing over the course of the summer. You also note that there are a number of competing projects locally, and I am sure there are all the member's constituencies projects that are competing for this kind of support and funding back all those issues. What extent is that a problem that is preventing us from getting from where we need to be? I encounter it quite a lot down here, where groups are almost arguing with one another that they should be receiving financial support to deliver those services, but it does not seem to be to me to be any clear way through this about who delivers the best solution on the ground. I am going to ask Antony to come in a moment to say a bit about how the partnership working is working to be a fairness successfully in many places, but if the commissioning model turns into competition from the various providers, the extent to which that is a barrier to delivering effective services. I think that there is evidence from our audit work and from other reports that for the third sector it does feel like there is sometimes an imbalance of power in terms of their ability to access resources and contribute to developing and implementing new services, many of which I think would be focused on prevention and avoiding people relapsing back into problem, drug and alcohol areas. There is an issue around that that needs to be thought about in terms of the commissioning arrangements, the local planning arrangements and the way in which ADPs work with partners across different sectors. That is a very fair point, Mr Coffey, so I think that we would recognise your observations there more widely. Just going back to your starting point of your question, Mr Coffey, to do with the shift towards prevention, in the briefing paper I think that we do highlight other evidence that supports your kind of overall position, which is the hard edge report that we reference in power 20 that highlights the real need for quite significant shifts of arrangements and planning for delivering not just these types of services, but services for other people that have complex needs. It is very clear that there is still much more that can be done by public bodies working with others to become much more flexible and much more focused on the needs of people, families and communities to deliver different types of services or deliver the better outcomes that Stephen was identifying. They drawn in that in the briefing paper, we highlight the issue of the lack of access to some community-based services being a problem for people passing through the criminal justice system as well, which can be a problem leading people back into the community justice system when, perhaps, if other services had been available, they might have had better outcomes, if I can put it that way. That is a really important point, Antony, especially during Covid, when people were coming out of the criminal justice system as you put it. They were finding access to those support services particularly difficult and know that from experience locally. If we can do anything to reinstate and recover that aspect of the service, I think that that would really contribute towards turning this round, at least in part. I just wanted to ask my last question about a governance aspect of it, Stephen. Your report also reminds us that the Government and the COSLA had agreed eight recommendations to improve the whole governance and accountability of the various services and that that led to the development of the partnership delivery framework for alcohol and drug partnerships. Could you say a wee bit more about how that has been progressing, please? If we are able to, we will, Mr Coffey. We note the work that the Government and the COSLA are doing together, and the eight recommendations that we touched on at Paragraph 24. I am not sure that we have an update on them, although I think that the minister in one of her written responses noted the progress and that there is planned publication of progress against the recommendation that is pending, but I will pause for a moment and check with colleagues if we have any further information on how that is progressing. No, I do not think that we do, so if we are able to come back in writing, it might be something that the committee might be able to pick up with the Government and the COSLA directly. I think that that is something that we will probably follow up. Thank you very much for that. It is very from Mofi. Thanks, community, back to you. Thanks, Willie. I am going to turn to a final couple of questions to Sharon Dowey, who is also joining us via video link this morning. So, Sharon, over to you. Good morning. Another question on governance, looking at paragraphs 28 and 29. The Scottish Government consultation on a new national care service shows that a majority of respondents agree that ADPs should be integrated into community health and social care boards. What is your assessment of the cost of doing so, and would this improve lines of accountability? So, it would be interesting to see, Ms Dowey, as to how the structure of the national care service evolves in following the Government's response to the consultation. If it is the case that alcohol and drug services are included under the national care service and whatever shape and structure, I think that we see that as an opportunity to bring clarity to some of the challenges that we know in the report about complex, difficult to navigate governance structures. That is captured in a clear plan that Anthony has already mentioned, in terms of bringing out the real benefits of partnership working, but with clearer accountability and setting out what the intended measurable transparent outcomes will come from that. What we have not done in direct answer to your question is to undertake any assessment of the cost or full benefits of that. As we refer to in today's briefing paper, we plan to undertake further work on drug and alcohol services and very likely progress that will be made towards a national care service. There are opportunities for us to report further to the committee on how the Government's plans for national care services and drug and alcohol services are developing. One of the lines that I stuck out in the report quite a bit was the most concerning, was that most drug-related deaths are in people aged 35 to 54, but that is increasing across all age groups, particularly in people aged 25 to 34, which was something that Gillian Matthew referred to earlier on. It is a focus of all parties that the increased funding gives a vastly improved outcomes. We noted that you recommend a number of actions that the Scottish Government needs to take at paragraph 31 to increase transparency and demonstrate value for money and the funding for drug and alcohol services. Has the Scottish Government accepted that this work needs to be progressed and, if so, has it any interim targets for undertaking the work? The impact of funding is one of the core purposes of today's paper. We are keen that the Government sets out transparently—as we have mentioned once or twice already this morning—that the spending on drug and alcohol services is clear to the Government, its partners and users of the services. What is making the most difference? Through our reporting, we have cleared our report with Government in terms of accuracy. We note some of the ministerial responses that welcome our report. What then translates into the Government's plans, we will continue to engage with them and we will see what comes next in terms of our recommendation that there is an overarching plan that draws together the national mission, the strategy and the work of the drug deaths task force. Ultimately, as we hope to deliver clear, transparent and improved outcomes, as part of our on-going work effectively is our answer, Ms Dewey. We will draw the evidence session to an end. I thank the Auditor General to Anthony Clark and Gillian Matthew for joining us this morning. We have looked with a great deal of interest at the briefing paper and the evidence that you have provided. We will clearly need to consider what our next steps are as a public audit committee. I thank you very much for your time this morning and I will now move the meeting into private session.