 Dr-гаith. Welcome to the 12th meeting of the Public Audit and Post-legislative Screwting Committee. Can I ask everyone present to please switch off their electronic devices or switch them to silence so that they do not affect the committee's work this morning? Item 1, the committee is invited to agree to take item 3 in private, as noted on the agenda. Do members agree? They are. gyda'r gweithio gyda'r gweithio, Mike Rumble's MSP, you're very welcome. Item number two is the evidence session on the Auditor General for Scotland's report entitled common agricultural policy futures programme and update. We want to explore in more detail some of the issues arising from the Auditor General's report and also to understand what broader lessons the Scottish Government has learned from this programme. I'd like to welcome to the meeting this morning, Leslie Evans, permanent secretary, Liz Ditch Burn, director general for economy, Eleanor Mitchell, director agriculture, food and rural communities, Nicola Richards, director of people and Ann Moises, chief information officer all from the Scottish Government. I thank you all for being able to attend this morning after we rescheduled the meeting from our original date. I invite Leslie Evans to make a brief opening statement before I open up to questions from members. Thank you, convener. For this morning, I want to look briefly to the past and then ahead to the future of CAP futures. Firstly, I want to reiterate the apology made and given by Liz Ditchburn to those farmers and crofters who have had to cope with delays and significant uncertainty with their 2015 payments. As a Government, we have not delivered the level of service that people expected. The Cabinet Secretary for Rural Economy has already apologised and I echo his apology this morning. Secondly, in my letter to committee of 3 November, I apologise for the fact that, in their committee appearance 29 September, officials did not proactively raise the miscalculation of the loan offer for a proportion of potential loan applications. Their view at that time was that this was an operational matter for which corrective actions were already in place, but it would have been helpful for the committee to have been informed of the issue and the action being taken, so I'm sorry that that did not happen. Looking to the future, we have some greater confidence about CAP 2016 payments than with CAP 2015. Why? Well, there are three reasons. Firstly, the underlying system is better. We're continuing to address coding issues, have been stress testing the system and are confident that it is more stable. We're planning and coordinating the work better, including the phasing in of different functionality IT drops. Secondly, we have improved governance and decision making and we have a more positive and engaged workforce and teams. Thirdly, we've established a culture of greater certainty in our commitments and of learning from past mistakes. For example, advice and support from internal audit now providing a greater degree of assurance on some manual processes. However, we cannot be confident of total success, not least because we remain reliant on more functionality drops to deliver the CAP compliant system which we need, so I cannot commit to there being no further errors such as those on which we recently wrote to you. Indeed, my colleagues will want to appraise you of an incident yesterday regarding some data handling. CAP represents over 18,000 businesses, many receiving two or more transactions within a complex and complicated regulatory regime. There can be no guarantee of perfection. In summary, we have a qualified sense of improvement but absolutely no room for complacency and we remain vigilant on the quality and responsiveness of services for our customers, the farmers, crofters and all involved. Thank you very much, Ms Evans. I'm going to open to questions first from Liam Kerr. Good morning. I just want to bring us right up to where we are today and talk about the loans, the national basic payment support scheme. We've obviously had a letter on this in the committee and there are 166 businesses overpaid £746,000. Can you just give me an explanation, because we've got a wee bit in the letter, but can you give me an explanation on how this has happened, please? I'll ask Liz Ditchburn and Eleanor to perhaps give a little bit more detail about the background to this. Oh, thanks. As you know, the loans are paid through a separate system from the main CAP future system. It's a separate system that we built for the 2015 loan process and are using again for 2016. What happened in the second batch of payments, so the first batch of payments, which went out on the 4th of November, went out completely successfully, so that was 12,500 payments went out totaling around £256 million to farmers and those were successful. As we continued to process applications which had come in later than that, in the second batch of payments, which went out on, I think, the 23rd of November, which was total of 602 cases, went out in that batch. 166 of them, as you said, contained an error. This was an error where the formula for calculation of the exchange rate from euros to sterling was changed erroneously and therefore it calculated the wrong numbers. Obviously, that error was that the spreadsheet should not have contained an unprotected cell of that nature and that's the issue that we have picked up and which we have now corrected in making sure that spreadsheets have appropriate levels of protection, but we can confirm that the previous batch of payments, the 12,500, was not affected with any such error. Okay, so just on our letter, it says that it appears to have been caused by human error, so you're confirming that it was caused by human error. Indeed. Our letter also says that it was accidentally changed by someone, so have we identified who? I don't know, Alan. You may want to say more about the investigation that you undertook. Yes, we have identified the individual involved. Right. That's part of your team or part of, it says in our letter, a team outside of the loans team. Is that someone that's part of your team employed by the Scottish Government? Yes, it is. Right. Just turning on to, we see, because obviously you're looking to get repaid or we are looking to get repaid and the letter says that you're invoicing to get back the overpayment with a repayment term of 30 days and the policy is not to charge interest on that overpayment, so what happens if people haven't repaid at 30 days? Well, as of 5 December, we have spoken to 159 of the individuals involved and we are still progressing the ones that we haven't been able to get in contact with. All but two people we have spoken to have been very willing to repay the money and have said that they will do so in the appropriate time period and will continue to follow up with the two who have not yet confirmed that they would make the repayment. However, all of those individuals will be due some further moneys so we would be offsetting moneys against future amounts paid to them. But what happens if, for whatever reason—so there are 10 or 11 people who haven't been able to contact yet—we don't know why—Seven cases. So just to take them for example, let's say that you are unable to contact them in any way so that they can't repay for the 30 days, what happens to their payments after 30 days? Do they pay interest on those? No, the 30 days won't start until they're contacted. So we'll continue to contact them. Clearly, these are all our customers. Sure, but will they pay interest if they don't pay back after 30 days? No. We haven't contacted—so if you're talking specifically about the seven we haven't contacted, we will continue to try and contact them. The 30-day period won't come into effect until we have contacted them and they should have them with a letter. And if you do contact them and they don't repay for 30 days, will you charge interest on those overpayments? We need to take some further advice on that. The people we've spoken to—the 159 we've spoken to have all—the 159 have all confirmed that they will repay within the 30-day period and we would expect them to do so. But you're unable to answer my question. Well, I heard the point that Alan May earlier on is that all of these people, I think, without any exception, are due additional money. So the money will be recouped—in other words, there is another payment to go to these individuals, including the seven, unless I'm incorrect any bigger. So the money will be recouped back to the Scottish Government through a reduction in the money that is due to them by those seven if they have not paid during that time. Can I say, I think, the other thing, the other principle that we will use to go through this in detail on our case-by-case basis is that in any debt recovery process we would always look to have that discussion with the individual and understand what their position is. Legally, we are clear in the terms and conditions that we have the ability to charge interest, whether we then choose to do so or not, would be very much about the individual case-by-case basis and the way on which we choose to understand how a particular customer is approaching it, as I think anybody would do in seeking to recover a debt. Are you able to tell me—because there are a lot of payments going on here and a lot of different sums—now, if I'm a farmer, this is going to be complex for me. I'm finding it complex sitting here and I haven't seen all of this correspondence. How detailed is the information that you're giving to people so that they know what's going on? In terms of loans or in terms of the normal BPS cap payments? Well, all of it, because there are, as you quite rightly point out, a large number of payments and some of it is this and some of it is that. I find it rather complex. So, as you know, I think as we discussed with the committee in the previous hearing, there have been delays with the letters with respect to the BPS payments. In a normal year, we would want to enable—we would want to give letters out as soon as possible to sell people. This is your entitlement. There are three letters. This is your entitlement. This is the payment that's now been made on the basis of that and any letter referring specifically to any reductions or exclusions that were made in that particular case. As we said to the committee last time round, those letters were not able to issue prior to 15 October because we were prioritising making the payments. We are now working our way through those letters, so let me make sure that I've got the detail on this. The entitlement letters were issued on 18 November, so that's information that farmers have had since the last time we were in front of this committee. The payment letters, which tell people how much money they're being paid under what scheme, began to be issued on 28 November. 14,000 have been issued, I think, to date, as the latest number that we have, and they're being issued at something around 2,500 per day. That process will complete reasonably soon for the full population. The reductions and exclusions letters will not go until next year. One of the important things for farmers—farmers are getting information and they will have more information—obviously, we understand that that's frustrating and concerning for them that they haven't had that full information as quickly as we would want them to have it. The appeal process, which farmers can rightly go through if they believe they've been paid an incorrect amount, has a 60-day period, but the 60-day period will not begin until they've had that appropriate letter. Nobody will be unable to appeal or disadvantaged in putting forward an appeal because of our delay in issuing those letters. We are working our way through the issuing of those letters as quickly as we can. I have one final question on the loan issue, which is simply just at the Auditor General's report back in May. For example, on the summary page at page 5, this loan scheme was addressed. The Auditor General specifically says that this introduces risk to the Scottish Government budget, including risk of duplicate or overpayments and delays to other spending if they are not repaid when expected. Lessons have been learned, we understand, but this report was back in May seems to have flagged that there could be an issue with the loan scheme and that the robustness of the system may not be entirely or is a cause for concern. However, now we are in December, and the exact issue that Auditor General seems to have flagged has come to pass. Have lessons been learned? Can we have confidence going forward? It's clearly regrettable that these mistakes have been made, these errors have been made, and, as the permanent secretary said, we are deeply sorry for the inconvenience to any farmers or crofters who have suffered as a result of this. However, the vast majority of payments were made accurately. 12,500 farmers and crofters have received a nationally funded loan, based on 80 per cent of their 2016 basic payments. The teams are processing the vast majority without error. It's regrettable that the issue happened in terms of the reversal of the exchange rate, but we have now got internal audit in. They have checked our spreadsheets and they are continuing to work with us to make sure that the manual processing that we are doing around the payments in these systems are as accurate and as good as they can be. Alex Neil Can I just start with the issue of interest payments on whether those people, the 7 or the 9, will have to replace money? The issue is not resolved on whether they are going to charge them interest. Those farmers who were very late in getting paid by the Scottish Government the money that they were entitled to, did you add interest to their payments? You didn't. So why, even considering adding interest when the mistake has been made, even though they might take some time to pay, surely we would be morally absolutely the wrong thing to do? I think that Liz made in her response a clarity and a differentiation between having the authority to charge interest and the decision about whether that is appropriate or not on the 7 that remain unpaid. That would need to be very carefully thought through about whether or not it was appropriate to do so. There are circumstances and there is history around this project, as you know, where people have had to be patient, where they have had to respond to the circumstances and the operation of the delivery. We are quite cognisant of that. I think that Liz was trying to differentiate between the authority that we have to pay interest and whether or not that would be exercised in certain circumstances. On the 7, there are not seven people who have refused to pay. At all, we have not contacted them yet and we will continue a lot. I am using the hypothesis just in case. I think that there are two who you have indicated have not yet confirmed that they are going to pay, but you are saying that you will just stick that off their money with the point? No, I didn't say that. There are two who have not confirmed. We are continuing discussions with them. There are seven who we have not yet been able to make contact and the area office staff are continuing to try to attempt to do that. That is what I am saying, but I have to say that I would have thought that, given that you did not pay them interest when the payments were so late and so badly handled, it would be rather odd if you charged them interest, which, for a situation, arose because of incompetence in the Scottish Government. Our position is that we have asked them to repay within 30 days, and we have said at the moment that no interest will apply because this is an administrative error. As I said, we would, of course, take advice if people refused to pay. We have the option of repaying over future payments that we make to them, but, as Liz said, there would be an option to charge interest after that date, but there is no decision on that being taken. If you do, what I am saying is that there is one law for them and one law for you. If you use the same logic, you should have paid interest as a result of the substantially delayed payments if you are going to apply the same logic. I think that the only thing that I would add is that, of course, the cap payments are on a very different basis. They are regulated by the European Union processes, and our legal obligation to pay farmers, as set by the regulations, is before the June deadline. Of course, we would have wanted to pay farmers well in advance of that, but that is how the European regulations are set up. In terms of the loans, it is very important to recognise that this loan was offered on an opt-in basis. We are offering farmers an option of a loan with full transparency on the terms of conditions and if they chose to take it up. Of course, we absolutely regret the error in terms of miscalculation of some of those loans, and we take responsibility for that, but we are going through normal debt recovery processes. On a financial stewardship basis, it would be remiss of us as a Government if we were issuing loan offers without having the kind of protections and interest arrangements in place that anybody would expect when someone is making loans. Clearly, in taking the decision whether to apply interest, you have to take into account that the loans were instituted in the first place because of the huge mistakes and the incompetence in the Scottish Government, and then because of the subsequent incompetence in mishandling and miscalculating the 166 loans that were issued? If we find ourselves in a situation where a farmer or a business customer decides that they are not willing to repay, then, of course, the full context will be taken into account as we make that decision. Can I also ask—I mean, this latest mistake, and then there's another one that you mentioned yesterday, but this latest mistake with the 166, it says in the letter from Fergus Ewing to the convener dated the 7th of December. The reason for this was that the formula for turning euros into sterling was changed for these cases. Instead of multiplying by 0.85, the figure was divided. This appears to have been caused by human error that the formula was accidentally changed by someone during the data inputting process. Is there no quality control? If this was a private sector, that would have been picked up by a quality control team. Do you not have any quality control whatsoever? We do have quality control. No, it's not. It hasn't worked in that instance. My assessment would be that this is indicative of a number of teams and people that have been working under sustained pressure for a long time. I think that it is regrettable that these errors are continuing to happen, but I think that it's indicative of some deep-seated issues around tired stress staff. You're the management of what you're doing about it. You're coming here every session apologising, saying you're sorry. We hope that it doesn't happen again. The permanent secretary in her introduction remarks made it clear that we should expect even more mistakes possibly happening. You don't have a level of confidence that this thing is going to be handled properly from here on in. This is now 15 months into the fiasco, and you still don't have the proper procedures in place. You've got tired staff, overworked staff. You're the management of what you're doing about it. We'd very much like to talk to you about that, and Ellen will explain in more detail. It would be interesting for you as a committee to have her perspective in terms of what she's seen, observed and the actions that she's putting in place over the last 11 weeks or so since she's been in post. The permanent secretary mentioned an issue that happened yesterday, which I would like to inform you of now so that you have that full information. As you know, we're already in discussion with you about a number of errors that have now been communicated in writing to you. I need to inform you of an administrative error in an email sent to beef efficiency scheme applicants yesterday, which meant that the email addresses of other applicants were visible. This is a data protection issue, data handling issue. We take the privacy of our customers extremely seriously and we apologise the same day yesterday for that error, and we are in the process if we have not already done so, and Moises may have the latest of reporting the potential breach to the Information Commissioner. However, as Eleanor says, this underlines still further the depth of the challenges that we are facing and the impact on teams of working under sustained pressure for a very long period of time now, and indeed the full impacts of the complexity and the number of schemes which the Scottish Government is running with respect to common agricultural policy payments. Of course, in addition to the schemes that we've designed, we've added in, as a result of the challenges and the problems that we've faced, further schemes such as the loan scheme, and this level of complexity and challenge is not something that we're going to get out of quickly, and I think we want to be honest with the committee about that. I did talk about this a bit in the last time that I was here to give evidence to you, and I think the way I described it was it is a long, slow grind which involves putting in place the appropriate protocols and processes, and that is indeed the case, and we need to be honest with you that there is no quick fix to building strong, robust systems. We've got significant work and progress going on in terms of a strong, robust IT system, but the people systems and the way in which we manage people and the way in which the protocols, the quality assurance, all of those things that we need to have in place and we need to be consistent across the piece, that is not where we are currently, that is in part the impact, the result of the kind of working that's had to happen necessarily to get payments to farmers over the last 18 months, but we are now still living with that legacy, and Eleanor, perhaps you'd like to say something more about your perspective on that and how you are seeking to turn that around over the time periods that we're talking about. Thank you. So, as Liz said, I've been in post now for just over 11 weeks. I mean, I've spent my time, clearly there's been a lot of work going on in those 11 weeks around the finalising of the 2015 payments around making sure the teams are prioritising the working loans and working and delivering the assurance for the 2016 cab round that has just started. I mean, the issues that I have uncovered are largely the issues that have been raised in Audit Scotland reports another, so I have spent significant time reviewing protocols and desk constructions. I have asked an internal audit to come in to review how we do things in terms of our use of management of spreadsheets and our control and checking protocols, which we have now changed as a result of that. We have taken steps to fill some key vacancies that have been left vacant for some time, including 24 agricultural office staff, some 20 field inspector staff, businesses support staff and staff in the finance teams. I have reviewed our approach to risk management and we're now part of a wider Scottish Government pilot programme on risk management and taking steps to improve our performance management arrangements across the team, including supervision of staff undertaking these key roles. I think the obvious question is to the permanent secretary, why has this only happened in the last 11 weeks when Ellen are committing? Why has this not been in place long before now? I think there are several reasons for that. I mean, the first thing is we do need to go back, and I know that the Auditor General herself has recognised this to the origins of the project, and we are still feeling the ripples and the resonances of a project which was set up in incredibly complex circumstances, where our response to late and continually changing regulations from the EU up to the very last minute, in fact, even when we were due to be producing and operating the system. Our own response to that was complex. We chose to take a more complex route in the way that we applied policy. There are a whole range of circumstances which prevented us from producing an IT specification in the right time and in the right circumstances that would have allowed us to have been more front footed in what we were doing. So, all the way back to the beginning of that project, we are still finding that we are uncovering and finding difficulties that have their routes in that space. The second thing is, and I would want to really stress this, I could not have asked the team to work any harder, and the teams that preceded Liz and Eleanor. They are now learning more and more as we go out of and continue to try and move from an emergency response rate and a react rate to a greater level of certainty so that we can start to plan further ahead. We are making steps on that, and Eleanor's appointment was one of the very firm commitments that I asked Liz to make when she took up her post at the beginning of May about the changes that we needed to make to get the next session and the next payment responsibilities and commitments out in better order than 2015. There have been a range of other activities and actions that have been taken, including at my hand and at Liz's. The ones that I would focus on are the ones that we have learned from what has gone on in CAP, and we are applying that to the wider understanding of what we need to be better at and where we need more robust systems in the Scottish Government as a whole. I take my responsibility as PAO in that order very seriously. We can talk a bit more about what those are in due course, but we have a project and a programme that had the most difficult birth ever, which is still now resonating in terms of some of the circumstances. We have a team who bust a gut to use a colloquialism to keep the system on my instructions focusing on compliance and on customers. We had to take some sub-optimum decisions around that time. Again, I take responsibility for that, but my focus and my focus and challenge and support to the AO, to the accountable officer of that time, was to focus on customers and on compliance, and that is what he and his team were doing. It is still the focus that Liz and Eleanor have continued to prioritise in the period of time since then. I do not think that any of us would want to blame the team who is working flat out to try to help this. I think that the issue is the management of the whole thing from day one, and we are still getting these mistakes. At this stage in the game, if you have a tired team, then you bring in additional people to untie the team because the more tired people have the more mistakes there will be. It seems to be the basic rules of management. If you were a private company, you would be out of business. Those mistakes are becoming almost daily. This is 18 months after this has started. This is an unacceptably poor performance. We cannot be sitting here in six months' time when you are coming back. We apologise for another two mistakes this week, for another two weeks before we have had to have a new loan scheme. This is public money that we are talking about. It is people's livelihoods. We need something far, far better than that. That performance is not acceptable. I believe that it is not good enough. That gives me no pleasure to come before the committee and to explain difficulties and, indeed, mistakes and errors that have taken place. However, I would mislead in you if I did not recognise, as I think that you have heard from some of my colleagues, the complexity and the difficulty that we are still working through even now. You talk about management and responsibility. It is nothing complex. Of course, we all make human errors. The human error over the exchange rate would not, in any way, castigate somebody for making an error. We all make errors. However, the problem is that, given the recent history of it, there should be a QC system in place that picks up the error before it goes out to the customer. Similarly with the mistake yesterday. It seems to be that there is no QC system in place for picking up the errors. Eleanor has talked to you a bit about and can share a little bit more about what we are putting in place at the moment. The focus that was taking place prior to this was very much on ensuring that the IT system was going to be producing what was required to enable us to get vast numbers of payments to 18,000 businesses and to inject money into the rural economy in the way that we know that we needed to in a timely fashion. We have greater confidence in that IT system as a result of all that work and as a result of an IT assurance system that was introduced and which I commissioned for the whole of the Scottish Government. Ann May wants to talk a bit more about that in the meantime. However, it is not all about IT. It is also about operational skills, operational management and good and effective use of our resources. Liz, on her appointment in May and earlier to that time as well because we had previous reviews, ones which I've instigated as well as the gateway reviews and the Audit Scotland reports have highlighted the importance of us investing in our staff and of us continuing to move people around in a flexible and fluid way. That was very hard to do. In fact, I would say it was almost impossible to do whilst we were still fixing things in flight if I can use that term. So in order to ensure that the IT system could deliver what we had committed to it delivering, we had to be able to carry on fixing flight. We now, I have to say and I'm delighted to see it having seen the people's survey results which came out a couple of weeks ago, have a more engaged and happier staff than we have in previous years and that is as a result of some of the efforts that have been taken to improve management support resource allocation and indeed a redesignation of roles which has also taken place in the first half of this year deliberately to try and strengthen the operational nature, the size and scale of that operational nature of the programme and to ensure that wherever possible we are able to give assurance and confidence in the responsibilities for delivery ahead. To be honest, as PAO I would be misleading you and I would be giving poor advice to say that there will be no more errors in a situation which is as complex as the history as this does and is still responding to absolutely immutable deadlines which we have always adhered to or tried to adhere to and secondly, overlaid by complexity which was decisions taken at the very beginning of the setting up the programme in response to stakeholder request which makes us unique within the rest of the UK. It's getting somebody to double check the exchange rate on a manual system and that would be par for the course in any system. Although I appreciate the complexity and I appreciate the IT problems and I appreciate the fact that everybody's working flat out to try and rectify it but it will never be rectified if the systems management systems aren't in place and the basic management system is a quality control system to make sure that mistakes like this don't continue to happen. Can I ask the latest figure how much additional money which wasn't originally budgeted for, how much does this fiasco now cost the Scottish taxpayer in additional cost? I can only give you the amount of money which has been given in terms of overtime because that is the figure which is over and above the envelope which CAP futures has been ascribed since May 2015 so we agreed in May 2015 we revisited the business plan and said that CAP futures would cost £178 million that is the envelope that we're still working to. In addition there has been some additional overtime which I think there was a letter that was written to the committee earlier on this year about the numbers of staff that we deployed during 2015 and indeed during 2016 as well. What's the cumulative actual spend, over spend to date? The overtime costs for the arpid area office staff in 2015-16 were £348,000. Some of that, a good chunk of that would have been normally expected to be taking place because it is part of the way the system operates. We've tried to do some analysis and break that down a little bit more and at the moment my understanding is it's about £150,000 more than it would have been in normal circumstances. So for example, Eleanor's position, her job which she's been brought in the last 11 weeks, was she replacing somebody? She was replacing. So have there been any additional posts created to deal with this crisis? Liz will keep me right on this but I think the one that we would accept, we would say as an additional post is the chief operating officer which is the one which operates the control room which is the crucial element between the centre and the area officers in delivery and it was a really important one. Is that included in that additional cost figure? I'd have to check that for you. No, it's not within the overtime figure because it's a core post. Could we get an up to the full breakdown of all these cost figures please? I don't mean just no bit by later. I think the challenge is that it's very difficult to say, for example even the overtime figure, so for example Eleanor referred to a number of vacancies that have remained, posts that have remained vacant. So it's very hard to actually track completely within these budgets a situation that we say this is the situation as would have been, this is the situation as turned out to be and what the difference is because there are obviously the whole agriculture policy and the whole directorate that Eleanor's job overseas contains a whole number of other functions and we move people around as flexibly as we can to ensure that when there's a gap, for example on the payment side, we're able to bring someone across. We're not always tracking that as a budget movement because we just pragmatically move someone from one team to another. I just want to let you know that I think it's going to be very difficult to give the precision in the figure that you're seeking because a lot of these things are just moving around. With your agreement with the EU there's a budget line for administering the scheme. Surely agreed with the EU, is there not? Well it doesn't need to be agreed with the EU, that's our decision. There is a budget line about the cost of administering the scheme. There is a budget line within our internal budgets for the rural repayments, what's the I stand for? Inspections division, which is the place that oversees the scheme and manages the scheme but within that there are a whole range of functions that they're doing as well as just strictly speaking administering a particular scheme so they're developing new schemes etc. So there's a whole range of functions that sit within that but yes we know exactly how much it is. You must have estimated the cost of this, right? So it's a simple question. Wherever you estimated the cost of this originally to be compared to the cost that's actually taken place is the additional cost that it's cost. That's the figure that I'm asking for. Okay, I'm sure we can give you the budgets, we can give you the original budgets that are set and the outturns for the arped division by the budget against the outturn. We can give you those figures. Keith, thank you. Mike Rumbles. I just wanted to mention that I'm here as a reporter for the rural committee and thank the convener for calling my question. I'm not sure the rest of the committee are aware but on the same day as this committee received the letter from Leslie Evans yesterday, the rural committee received the letter from the... you are aware of that letter? Good. So at the moment the ministers are informing us that just for the public who are listening to this and the farmers who are listening to this realise that, of course, they would be normally getting their entitlements by now in December. I want to refer to the loan scheme that's been offered. We've been told that 12,500 farmers and crofters have received their loan based on 80 per cent of their entitlement and 17,800 loan offers have been issued. That means that one third of farming businesses and crofting businesses haven't taken up the offer of a loan. Now my question is focused on this. One has to ask why this is. Could it be that farmers are not aware of the amounts of money that they are entitled to and we've already heard you commenting that those letters haven't gone out because I want to make the point that any business, any... our own personal bank accounts, if you've got to realise that when money appears in your bank account you don't know whether that's the correct amount of money unless someone has told you. So there's a feeling out there amongst farmers and I have had this personally from farmers that they don't know what this money is for, whether they're entitled to it. Is it really 80 per cent of their entitlement? So people are not taking it and they are also aware. I mean you say there are only 166 errors but they are aware of continuing and we've heard those today, these continuing errors and they don't have confidence about the loan scheme. So my question is basically this. Do you realise that the problems that farm businesses have by a reluctance to actually take what's on offer from us, their lack of confidence in the whole process is undermining their own businesses and I'd like a reaction to that. It just seems to me that there are errors continually coming about. In the letter that the minister wrote at Edward Mountain, he talks about not only the 166 businesses today but in your letter to Jenny Marra you mentioned one business paid £850,000 twice and 22 businesses received duplicate payments of over half a million but that information hasn't been given to the rural committee. So there's a whole confusion out there in Scottish farm businesses and I'd like your reaction to that. Do you not appreciate that all those difficulties are really adding to what appears to us to be a crisis in rural Scotland? I do understand and I do recognise the picture that you're painting and I do understand which is one of the reasons for my apology. The impact that this has not just on farmers and crofters but on the businesses that sell to farmers and crofters indeed. I have been to nine meetings with area offices in Portree where I know some of the community there actually. I have been to Orkney, I have been to Oban, I have been to Inverness, I've been to Pentland House and Salton House. So I've been talking to people who have been in daily contact with the people that you talk about and they are very clear about what they're hearing and feedback that they gave to me on that was a very compelling story. So I do not underestimate the impact of this at all. I'll ask Liz to talk a little bit more detail about the process that's in place at the moment but I do know that we are contacting everybody who is entitled to take up a loan to try and assure them and also to give them the opportunity to take that. Why do you think they're not taking up the loans? I can understand why it is that they may decide not to take it up. I'll pass on to Liz for some more detail about that. The only other thing I would say is I took a decision as PAO to ensure that this committee and other committees should be informed of when we make errors. I did that for two reasons. One is because I feel that we have to be upfront, clear and very frank about the circumstances and the improving confidence but still the risks that occur for reasons that we're talking about this morning. Secondly, we know that people in the community know there's an error going on so Parliament needs to know about that as well. I want to be upfront and open about this but I am not apologising here only to farmers and crofters. I also recognise the difficulties that this place is for our area staff as well in their relationships with them. I do recognise it absolutely. We are working hard to try and resolve it. We are talking about some of the very specific actions this morning that are being placed under way both in the specifics of ARPD and in Liz and Eleanor's area but also more widely the learning that's being applied across the Scottish Government and I can talk a little bit more about that in a minute but Liz might want to talk about the specific loans. An Eleanor should come in as well. I think so as you said around 5000 people have so far chosen not to take up the loan. We've contacted, it would be a very big number to contact them all directly. They've obviously all had the offer and they're obviously all able to contact and talk to their area offices. The team have phoned I think around 200 of them explicitly a sample to talk through indeed to try and understand that customer reaction in detail. Why did they choose not to take the loan up and did they wish to reconsider? I think there are different categories within that. There are clearly people who are absolutely confident on their cash flow and don't need to take the loan so they're absolutely clear. No, thank you very much for the offer but we really don't need it. Equally there are people who are more unsure, don't want to take credit at all, have got concerns about being in debt and a whole range of issues which I think are some of the ones that some of the feedback you've been having. I think it's also very important to say that we've had a lot of very positive feedback from farmers who have chosen to take up the loan and who have found that certainty extremely beneficial, have found it's enabled them to be confident about their cash flow, enabled them to plan effectively and so we have had some very positive responses as well but clearly we want to make sure that people no one doesn't take up the offer for the wrong reasons in a sense you know that they don't take it up because of their lack of confidence. As I think I said before it's going to take time to build the trust and confidence of the industry back up again and I think there's no shortcut to doing that. We have to deliver a better 2016. We wanted to start 2016 by making the absolute offer on the loan so that people would have some level of certainty but we have to deliver a better level of payment performance through 2016 and then we will hope to build that confidence back gradually from the industry but it is going to be I don't underestimate the time that will take to do and the impacts that that has in the meantime but Eleanor would you like to say any more about the kind of feedback that we're getting from from from farmers? Yes I'm happy to and just to give an update we did another payment run yesterday on loans so we've now paid out 12,824 loans totaling just over 261 million pounds and we have contacted as Liz said a number of a small sample of the applicants who haven't come back to us or potential applicants who haven't come back to us. We've also using the area office network as staff there to in their day-to-day conversations with farmers to raise the issue of loans and make sure that everyone is aware that this is a possibility and as Liz said there's various categories of people saying they don't want to take up the offer somewhere to do with the fact that they don't need the money, somewhere to do with the fact that they don't like the word loan and we were asked before to call it an advanced payment rather than a loan but there are issues around that so we decided to go with the wording alone. So we're not we're not complacent on this and we are we're continuing to raise the issue the agricultural staff when they're out on farms as they are every day raising the issue with farmers and crofters and making sure that and we're still doing active communication around this to make sure that everyone who wants a loan can access a loan. Briefly I'll ask the question where I'd like to know if you know there's something like four or five hundred million pounds should have been paid out by December normally and we've got an 80% of loans to two thirds of the way out. Where's all the money? Who's holding this money? Is it money that's held within the Scottish Government? Is it money that's yet to come back from the EU? Where is the money? So my understanding is it is within the Scottish Government budget. So they're holding on to it and the Scottish Government are holding on to this money? Well we're not holding on to it we have it there to be paid out and therefore it's not it's not doing anything other than any other money that's sitting in the bank. It's sitting in the Scottish Government's responsibility for accounts. Thank you very much. Perman, secretary, is there any risk that farmers or crofters may seek damages or compensation from the government for any material hardship that these delays or errors may have caused them? Although we have traditionally funded the payments in December the legal requirement and the penalty time is that we should have paid these by the end of June is my understanding. So although farmers have traditionally and croats have traditionally come to expect their payments in December in the early part of the year as Mr Rumble said in fact that is not the legal commitment if you can call it that as part of the of the programme. So I'm sure there is a risk we understand it to be a low risk at this stage but we are mindful of the fact that people feel cross many of them feel frustrated. Sorry what is the legal commitment around the payment of the programme? There is an expectation that the payments will have taken place before the 30th of June so they're not late in EU in EC payment terms until after 30th of June 2017. Yes. I mean that's a regulatory requirement within the regulations of the of the commission. I think we would be advised to come back to you with perhaps more with more technical detail on that. Liam Kerr. It was just on that. I'm just not sure if I get the answer. I think what's being asked is not and it does beg a question about whether there are fines. When we last looked at this there was a kind of contingent liability that if the money hadn't been paid by I think October of this year then there was a possibility of a fine but I understood that the convenience question was around is it not possible that a farmer who has been underpaid and has suffered as a result could bring a claim? Yes and I cannot say that that's not possible. I mean I was talking about the commitments that have been given. It is possible it is perhaps understandable that people feeling frustrated and so on will want to say how do we gain some satisfaction on this. So I cannot say that there isn't going to be a legal challenge. I suppose I was differentiating between commitments that have been given and people's decision to take civil action. Are you aware of any farmers seeking legal advice or indeed the NFU seeking legal advice on this? I'm not aware of that but I would pass that on to my colleagues who are a bit closer to that nature. I'm certainly not aware of any discussions we've had with the NFUS on this but I think we should come back to you with detail on this because it's important that perhaps those of us who happened to be in the committee this morning are not up to speed with the technical legal detail so I don't want to mislead you in any way so we will we can we can offer you more information. Okay thank you Colin Beattie. Thank you convener. Pernodd secretary this project is just the end of a number of IT projects that have come before this committee over the years. Do we have almost an endemic lack of competence in handling IT projects? We have seen no evidence that the skills are there to do this and I realise you're talking about the things you're doing to improve things but the evidence isn't there. So I think there are two questions there. One is about our performance on IT projects generally which I might pass to Anne to talk a little bit more about what we're doing to ensure that we have learnt from this and indeed other IT projects and what we've introduced on the basis of a commission I gave at the end of last year which is an IT assurance project. We actually have delivered some very successful IT projects as well they don't get much airtime I understand that. In fact the last time I was in front of this committee when it was called PAC I offered to send a list of the successful projects that we had undertaken and which were working well and I did send that that's probably not in your briefing pack and I understand that too. However we are not alone in finding large complex complicated IT projects difficult to deliver. In fact I think the most recent evidence and Anne will keep keep me right here is that about 6% of large software delivery programmes actually are deemed successful the rest are not. However we cannot be complacent about that and that is one of the reasons why in the early part of my time I commissioned Anne and colleagues to look at an IT assurance process for all our IT programmes now and in the future drawing on some of the learning from CAP but not uniquely that and looking at where we need to make some elements and some responsibilities mandatory where we introduce some stop go gateways on key decision points in a project's life and thirdly what the skills are and when we need to introduce those skills as early on in a project and programme design as possible and indeed where we source those skills from because as you will know very well it's a tough market particularly in Scotland where we're competing with the financial sector and others to attract people to come and work for us in these areas. Here we're not talking about the technical skills of the IT person we're talking about management competency some of the errors are so basic that they're breathtaking. We're talking about a combination of skills here actually we are talking about some IT skills we're talking also about commercial skills and contract management skills and we're also talking about programme management skills as well all of which combine as well as management of people of course the most important element of all all of which combined into a team that needs to be in place at the very beginning of a project. We've learnt that not just from this IT project but from others as well and there are a whole range of issues to do with the scoping of projects at their very inception a really key part the pre-launch testing and also our confidence in the way in which we have contracted and are holding to account the contractors for delivering IT services for us. The point about contracts do our lawyers actually look at these contracts I mean in the case of this particular one that we're discussing now it's a time and materials contract that was put in place whoever thought that was an intelligent thing to do for an IT contract in a previous one the NHS 24 the contract was a complete shambles. If I can talk about this contract and the point that you make there one of the reasons why we went down the route that we did I understand is because we had a very short small amount of time to be able to spec what the contract was going to have to do and even less information on the breadth and nature of what that contract's impact had to deliver because of circumstances which we're very familiar with in the way in which this project was brought into being and the regulations that we were subjected to by EU so in that respect we had to go down a particular kind of contract a partnership contract because we were not we could not find contractors who were willing to do to accept the level of risk that they might be exposed to alone in the circumstances in which we were bringing together that particular service and that IT contract so there are specifics to do with this the birth of this project which I've alluded to earlier on which made the choices quite limited on that score but I'm not underestimating what we have both learned from this project and others and the new assurance system that we're bringing to bear which is being tested now and live tested on some other big projects which we have in the pipeline but which will go fully rolled out to all of the score Scottish Government and other agencies at the very beginning of 2017 and can give a little more detail on the nature of that if that's useful. I'm a little alarmed that you seem to be positioning us for more bad news down the line. How at this moment are you aware of any issue that might come to the fore other than what was what happened yesterday? Are you talking about IT projects or just issues that allow? I'm talking about the specific IT project. I'm not aware of any but Anne may want to talk about that. No one on this particular project I'm not aware of any other impending issue but as the permanent secretary said part of what we want to do through the assurance process is to do some deep dive into some of the things that have already been delivered to ensure that they are fit for purpose going forward and that they have the flexibility and supportability built in that they can cope with changes that we are as yet unaware of as the process goes forward. So we are undertaking some reviews of a technical nature within the African Futures programme and that's starting very shortly. If I could just elaborate on that that's a very specific piece of work which the cabinet secretary has commissioned which is a technical stock take review which is looking at the IT system as is now and stress testing that under several headings for the gaps. Any vulnerabilities what options we might have to strengthen it given what we know is ahead for that system in the future. So your point about are there any more issues are there any more errors I cannot give you a categoric assurance on that I would be foolish if I did but the technical stock take review and I think we're appointing a supplier to undertake that this week if I'm correct will give us a level of assurance about what we have at our hand at the moment and where we need to take additional action to ensure we have greater assurance for the future. Given the track record in this particular project and the clear deficiencies in the management of it what's happened to the people who were responsible for the for this loss of public money? There's no one person who is responsible for this there's no one significant failure no it seems to be comprehensive. It has been a difficult complex fast moving very stressful set of circumstances for people to manage and there is undoubtedly a lot of learning to be drawn from this which is why I'm talking to the cabinet secretary in my role as principal accountable officer to undertake a review of what has been learnt from the very early stages right the way through to present day on this project and also to ensure that that learning is put to both good use within the project itself but across the Scottish Government for comparable delivery projects in the future. Nobody was responsible? I'm the principal accountable officer and have been since July of this of last year so I am responsible for what the Scottish Government delivers and doesn't deliver and I don't say anything other than stand by that responsibility. My role and my focus has been to ensure that we avoid any penalties unless compliant in what we need to do and that we serve customers as best as we are able within the confines of a project which has its roots back in origins which were none of us would have designed so I am moving it on within my time here and committing to make the IT more stable which it is and stress test and to ensure that the operational management has the skills and capacity and drive and pace that you heard from Eleanor and from Liz Ditchburn. Just to give an example, the Parliament works on the basis of performance-related pay. Has anyone had their performance-related payment withheld? The senior civil servants don't receive performance-related pay. They don't receive bonuses in Scotland. They do in white all they don't receive. Has anyone been penalised at all? There will always be an opportunity for a disciplinary process to be brought in disciplinary investigation if there is evidence of failure, of misdemeanor, of failure to carry out their job. I have not seen any evidence of a single point of failure. The review may bring up more information, more evidence of what did go wrong and how it went wrong. I am sure that there will be. Although I have to say that we have a massive amount of information. We have gateway reviews, we have the Audit Scotland reports, we have our own deep dives, some of which you are still to take place. We also have a huge amount of information about the way in which the project was managed and its governance and has been governed and the assurance levels. All that information will be at our hand for a review which, as I said, I will be talking to the Cabinet Secretary about in short order. The project that we have looked at in this committee never seems to be held responsible. It seems to be that it is redistributed elsewhere within the service, it moved on to something else no longer their responsibility. It is very frustrating. In the private sector, there would be nobody standing, quite simply. Given the size of the project and the loss to the public purse, it just would not happen. However, the frustrating thing is that there never seems to be anybody who is actually responsible on a day-to-day basis for this. I know that you say that you are ultimately responsible, but that is begging the point that there are people who are managing the thing on a day-to-day basis at various levels. We see the incompetence, we see the basic management failures, the basic questions that were not asked, the basic actions that were not taken and nothing happens. It is a differentiate between, as I said earlier on, what happened at the very outset of this project, which still resonates now. The way it was set up, the circumstances in which it was set up, the complexity that it was trying to deal with at that time and the very short amount of time that it had to deal with that and what people have been doing in teams, individuals and as accountable officer and programme management to put that right since then. They have been working both as part of operational and technical and delivery. You yourself, I am sure, will have seen or others around the table will have done the amount of time and effort that has been placed and the responsibility placed at the area offices alone, which I have witnessed. I have not seen any evidence of a single point of failure. That would be what would prompt for me the responsibility of a deeper dive into any disciplinary investigation. However, as I have said, I am talking to the Cabinet Secretary about a review to ensure that we squeeze every bit of learning on every level and on the points that you have raised for this project. Just one last question. Eleanor Mitchell mentioned about vacancies being filled. I think that if I got the figures correctly, there were about 40-odd vacancies that were filled. Are we just throwing people at this now? Not at all. The numbers that I mentioned were 24 agricultural office staff, and that is a regular annual or biannual cycle to make sure that we have teams going through and around 20 field inspector staff. That is in response to the new requirements and the new cap system to do more land-based assessments. We are not at all throwing resources at the problem. We are making sure that staff are able to take their time off to get a break, take leave and are able to do the jobs that they are being asked to do. Permanent Secretary, you are talking about the review of IT systems, but there is no mention of that in paragraph 4 of your submission. Why not? We are in the process, as I said earlier, of getting together the requirements and the skills to be able to undertake that review. That is why I want to share it with you today. You have not started yet. You are just preparing it indeed. That is why it was not in this paper. Were you preparing it at the time of the submission of this paper? Are you talking about the letter that I sent to you? I am talking about written submission from the Scottish Government on 3 November. We have been looking at, since then, and will keep me right about the exact date of this, but we have been looking at how we best address a review of this kind and look at the kinds of skills and circumstances that would make it most impactful. I cannot give you the exact date of when that commission took place. What are the comparable delivery projects in the future? I will ask Anne to talk a little bit about this, but where the IT assurance programme is being applied at the moment is on social security. We have a big project on e-counting, and Transport Scotland has an integrated ticketing project as well. Those are all areas where we would want to make sure that we have good use, early use of this IT assurance programme. I do not know if you want to elaborate on that. We are applying the new IT assurance programme to major projects, so that is projects over £5 million. There are currently 16 of them within the central government sector. The full deep dive, increased technical scrutiny, and the stock goal gates will be applied to all those 16 projects. The approach around digital first standards, which is about user-centric design, is trying to build the user experience into the whole system in IT design. We will apply to all projects across the central government sector, and there are 304 of them. I missed the first part of that. My colleague came over, but you said that there are 324 new projects. There are 304 projects on what we call the ICT risk register, because we have asked all organisations within the central government sector to give us foresight of projects that they are planning, as well as the projects that I have started or are on-flight. There are 304 projects on that register currently. Social security is one of those. It is a programme with a number of individual projects within it, but yes. My key concern is to follow on from what Colin Beattie was saying about delivery of major IT programmes. If we cannot deliver the cap payments, how on earth are we going to manage delivering social security? I know that the cap is complex enough, but I think that the powers that are transferring and the complexity of what we have to deliver to the amount of people that it has to be delivered to are probably far, far, far more complex. How can we have faith that that is going to be delivered without any of those glitches or without full-blown crisis? Ann Wale will talk about the nature of the assurance and of the mandatory level of this. It is not optional. It is not something that people working within the Scottish Government and the wider domain can choose to apply or not. This is mandatory. I think that there are two fundamental differences. I have spoken already about the particular circumstances of the IT project and the specification of the IT project against a backdrop of late changing and incredibly complex policy decisions that were taken. I am not suggesting that this is anything other than more complex, but the birth of the IT project was one that was very compressed and which already was building in our level of difficulty and vulnerability given the lack of ability for us to be able to specify something in sufficient detail. That circumstance is not in place for the social security system. The second thing is that we have prioritised, and I know that this has been a subject of discussion within the Parliament recently, how we and what time we need to make a transition to ensure that there is no failure at that point of transition. What we are doing is taking on, again slightly differently to the IT project for CAP, a series of customers and clients who are already receiving a level of service. In order to ensure that that transition is smooth, we are planning at the very earliest stages, since the very earliest times of us considering the new powers, how that can be phased in so that we have a much longer lead-in time. We have learnt from the kinds of skills that we need in the team and we are recruiting people and have recruited people with those skills at the very earliest circumstance, so they are in the team at the very beginning when we are even thinking about specifying. Just one example of that, we went out to try and ensure that we could get the skills we wanted to and we failed to do that. We did not just appoint somebody on the basis that they will pick it up as they go along. We went back to square one and decided to look again to make sure that we get the right skills and the right people with DWP experience. It is interesting that it is taken me to raise this, and it was not included in your two short paragraphs on lessons learned for future IT projects. It was the first thing that the First Minister said to me when I asked her about cross-cutting themes from Audit Scotland reports at the conveners group. The first thing she said was that we need to get this right for social security IT projects. It is just a little bit of concern to me that the paragraph that is entitled lessons learned for future IT projects, there is no mention of that at all, but if you can give me assurances that it is very high, all the new powers are very high on my radar. One final point, because I know you will press for time, but actually the IT system that we introduced for revenue Scotland, which is another example of new powers, not of the same complexity of social security is regarded as one of our great success stories and has been quoted as such not just by us, but it is award-winning in its performance. Okay, thank you. Ross Thompson. If it's okay, I've just got a couple of supplementaries just on the questions of Alec Neill and Colin Beattie. First of all, the permanent secretary in your statement to the committee said that there's no guarantee of perfection. I'm sure anybody understands a system where it's in the public sector, private sector, can never be wholly perfect, but the important thing is having a system which, although not perfect, does command confidence. Is there an acknowledgement that this incident does further erode the confidence amongst the farming community and that the goodwill that's being built up from the establishment of the loan scheme has now been undermined? Is there acknowledgement that that has happened? I will ask my colleagues to speak to that because they are more in contact with the community than I am on a regular basis. Of course, anything which is a negative following on from a positive will carry the risk of undermining that positive. I think what I would urge us all to do, I suppose, is to make sure that when we are in engaging with stakeholders and with the industry and with just the broader public that we're always seek to put things in context so that errors are seen for what they are in terms of the scale and the nature of them and that we don't let them become more of a risk to confidence than they genuinely should be. But of course, I accept that, of course, it cannot be a positive thing to see something which is apparently moving in the wrong direction. I think it is important that we all try and maintain a level of context around the nature of the good things and the nature of more challenging things. Following on from the questioning of my colleague Neil, as he was saying, it was very easy often to say, sorry, and it's often very easy to say, lessons have learned, but I think his question was round about the actual accountability. The committee has been advised that it was human error and miscalculation in this particular case round about the exchange rate. In relation to my question on confidence and restoring that confidence, you've talked about some of the short-term measures that have been put in place. In relation to longer-term measures looking further into the future, what steps will you be taking to identify risk and potential risk to ensure that that risk is reported to ministers? In relation to current staff, for example, is there any form of CPD for new staff coming in now that vacancies are being filled, the training programme that they'll go through, how robust is that? What measures will you be putting in place that are robust enough to ensure that we mitigate against these incidents and mistakes happening again? I'll cover each of those points in turn on risk. As I've already mentioned, I have asked for us to be part of a Scottish Government-wide pilot on reviewing how we look at risk. We are actually reviewing our risk register to make sure that they are capturing the risks and we are escalating them and dealing with them at the appropriate times. On governance more generally, picking up the recommendations that have been made in the Audit Scotland reports, my overall sense of governance is that we have not. Governance has been in place but it has not looked at the system as a whole rather than at individual work streams or projects. We are refining the governance arrangements to make sure that all aspects of the system are operational together and that we are giving the appropriate assurance to farmers and all our customers that we are doing the right things at the best times in talking to people about it. On CPD, there are a number of mandatory training programmes in place. This morning, I have written to all staff in the directorate and asked them to make sure that they have all undertaken the mandatory training and data handling. To complete that training this week, there is a clear and agreed training programme for area office staff when they are brought into the organisation. We also have leadership management development programmes within the directorate, which we are currently reviewing as well. I think that your final point was on the measurement of how we are making progress. We are linked into the governance work that we are doing. We are in the process of developing a range of management information metrics so that we are more able to see and understand the areas that we are making progress at the pace that we want to make progress in the areas that we want to focus attention on in the future. Thank you very much for that. On the side of risk and obviously going into the Scottish Government-wide analysing of risk, do you have your own risk register per director or agency? How is that communicated to ministers? Is there a dashboard that flags up to ministers? What is looking like? This is amber. Potentially this is red. This is something that is of real concern. How is that communicated to ministers so that they are aware of what risks are potentially impending? There is a range of escalation processes. Yes, there are risk registers, as I said, at project and workstream level. They get escalated up to divisional and directorate level and then escalated to the Scottish Government-wide risk register. We use a well-loan, regarded way of measuring risk and categorising it into red amber or green. I have regular meetings with the cabinet secretary and I would always undertake to make sure that anything that is highlighting as our red risk would be discussed with him. In response to that, it was Allan Neill's question that the permanent secretary mentioned that staff being happier than they have before. In relation to the survey that was carried out, what is the participation rate being in relation to staff surveying of their happiness or of their view? I know in some councils participation rates have been declining. Is there a decline in the rate of people participating in staff surveys and questionnaires on that particular issue? I will ask Nicky to talk about that. Certainly in terms of the Scottish Government, there has not been any decline in participation rates. We are doing everything that we can to increase that because it is such an important source, not just across the Government but in very granular circumstances because we have started to break it down to per deputy director. They know what their staff feel. Just to pick that up across the Scottish Government as a whole, the response rate is very good. It tends to be about 73 per cent and that stayed fairly constant over the years. We do this every year. Within the AFRC directorate that Eleanor Leeds, the response rate went up from 54 per cent last year to 61 per cent this year. We saw quite a good increase in the response rate, which I think is really positive. Across those measures, we remained at a SG level, quite static across the range of scores, not a huge amount of change on last year. The director actually bucked that trend and there were quite a few positive increases. The ones that we would be particularly alert to around having an acceptable workload increase within the payments and inspection team by 13 per cent. That is a significant uplift in terms of people finding their work more manageable and being able to see a way through. As ever, there is always lots to work on in there, but the fact that bullying and harassment scores went down, the fact that people could see a way through in terms of the way that they would work with others in their team to come up with new ideas, and it is all of that cultural shift of how to encourage people to speak up when things are going wrong, how to encourage them to seek support from others. When a team has been working really up against it for a long time, then it can be quite hard for people to seek that, but we are seeing at least some encouraging signs there. Following on the question from Colin Beattie, particularly when he was looking at who ultimately is responsible and has anyone been held to account and they spoke about disciplinary? Just as an example, I used to work for the Bank of Scotland, and I know that we handled lots of sums of money going into personal accounts and sometimes paying the deposits on people's mortgages. Given that it was Aberdeen and at that time, those could be significant levels of funding, particularly for a mortgage deposit. If anything went wrong and I made a mistake, you can bet your bottom dollar. I would be weaked into a disciplinary very, very quickly. Given that we have identified that there is human error, what disciplinary process has been enacted? I cannot understand why nothing has happened to date and that nothing has been identified. We were talking earlier on about the issue that took place most recently, which is the data handling. I think that Eleanor talked about the fact that she is undertaking an investigation to find out why that happened. That would be the process to trigger if there was a requirement for disciplinary activity, if one person or several people had been seen to be clearly failing in their duty and their responsibility. We take performance management very seriously. I have been in the same position as you have in terms of working in other organisations and undertaking the disciplinary process. I have sacked people, so this is not about whether we decide whether it is a good thing or not or whether we do not have a taste for it. This is an issue about appropriate performance management early on, ensuring that, going back to your earlier point, people have the right skills and tools for the job and that we are investing in those individuals. Clearly, as I said earlier on, if there is evidence that comes to light as part of the review that I am discussing with the cabinet secretary of greater understanding or greater evidence that I have not been party to, which shows a single point of failure, that would trigger another piece of work and would include us looking at our performance management and disciplinary routes. On pages 35 and 36 of the Audit Scotland report, highlights the conflicts of interests that were not dealt with effectively in its view in relation to the IT. It says, first of all, that the Scottish Government did not consider any conflicts of interest. It did not seem to be until a whistleblower in 2014 alerted the Scottish Government that the delivery director provided both CGI and Scottish Government with staff. It seems to be that, even after the Scottish Government were notified that the delivery director was still able of his own conflict of interest, he was still able to sit on a resources group, and then it seemed to take eight months for this conflict of interest to actually be formally recorded. Can you explain why processes were not already in place? Who was responsible for ensuring that they should have been and what safeguards are going to be put in place to prevent this from happening again? I will ask Nicky to talk in more detail about the policy and process. As you will be aware, there are areas at the moment that are under investigation, subject to live police investigations, so I cannot talk about those in any detail, although subsequently it may be possible to have a private conversation with the convener if that is something that he wants to pursue. Once aware of the potential conflicts of interest, the Scottish Government kept the individual on but amended the recruitment procedures from the summer 2015 so that decisions were taken by a panel, not by any one individual, including that individual. Also, all senior future staff, including contractors, are required to apply a conflict of interest registration rule, so the registration of conflict of interest applies as much to contractors and to our own areas of responsibility, although I believe that that was not complied with at the time. Nicky, do you want to say anything more about that? I suppose to reiterate that, given that there is a live investigation under way, it is something that we will need to come back to at a later date. In terms of the lessons learned, I think that there certainly are areas both in our whistleblowing policy and in looking at conflicts of interest. In particular, in the management, performance management of contractors and being very clear when contractors are bought in, the responsibilities that they hold when they are working alongside the civil service. I think that there is a range of work that has been done there and we have been working with our counter fraud group to understand what more we could do there. We have reviewed all of our whistleblowing policies and are taking those forward. In particular, we are trying to build a much clearer link between whistleblowing and the link into awareness around fraud and taking forward fraud investigations. When the Scottish Government was made aware by a whistleblower, given that we just talked about the processes in place for risk registers, was this ever registered as a risk? How was it monitored? I cannot speak about that individual instance. I would have to check that going back into the records and see, but clearly this is a risk that affects all projects and something that, given the strengthening that Nicky talked about, we would need to ensure that it was being taken into account appropriately in the future. I cannot give you a categoric answer to that, whether it was on the risk register or not, because I do not know. I can find out. If he could provide that to the committee, that would be helpful. Can I ask how—sorry—when was the last time the governance board met? Yes, both there are two under the new governance and assurance process that have been introduced earlier on this year. There are now two tiers of programme management boards and Liz might like to talk about the differences between those two, but one of them worked very recently at the beginning of December, as my understanding. December? How many times has it met this year? Actually, you will have a better grip on the detail than I do, but we have changed, that we have transitioned. I think last time I was in front of this committee, we were just on the point of making the change. We had agreed and decided the new structure, but had not yet moved to it. Since I have been in the job, for example, in May, I went to a number of programme boards. I am not sure if any of us have the detail of the number in our heads, but over the summer we had much more frequent programme boards, particularly on the run-up to the June deadline. We then, at the end of the summer, transitioned to the new structure, which creates a thing called the Executive Steering Committee, which sits on top of the programme board. I chaired the Executive Steering Committee and we met for the first time last week. I chaired the programme board, which is meeting. Since I have been in post, there have been one Executive Steering Committee, which was last week, and three programme boards. The latest one was yesterday afternoon. Since the Auditor General picked up the issues of governance in her report, have all key decisions been made by either the governance board or the programme board? Or have they been made by any other means? Since I have been in post, all key decisions have been taken at the appropriate governance levels. But you have only been in post 11 weeks. How about before that? The Auditor General's report was published in May. She made a very clear point about—she expressed some concern, I think, about how one or two particular decisions had been taken out with the traditional governance and programme governance, and that was what informed partly those comments and others—the revision of governance and assurance. In actual fact, the governance and assurance arrangements within the programme have come in the tail lights of a complete change in governance and assurance in the Scottish Government, which has been introduced recently at my instigation. I cannot say in terms of the programme about any decisions being taken outside, but that would be unusual and out of keeping with what the new assurance and governance process was intended to include. I think that there are two categories of decisions. It would be good to know a bit more about what you are particularly interested in. There are two categories of decisions that would not be necessarily taken in the programme board discussions. One is things that are discussed and analysed and recommendations made as a result of the programme board, which are then escalated to ministers for ministers' decisions. For example, the decision to offer a loan scheme for 2016 was a decision taken by ministers on the basis of advice from officials. Of course, because of the financial implications, that was not just a decision for the Cabinet Secretary for Rural Economy but also very much for the Cabinet Secretary for Finance. There are definitely decisions that are taken above, which are escalated for ministerial decisions, which come through the programme board structures and escalate for ministerial decisions. There will also be small operational decisions that are taken in between meetings, but which are at an appropriate level of operational decision, which are taken on an on-going basis. For example, as we were running the control room on a daily basis through the run-up to the June 30 deadline, operational decisions will be taken in the control room and the impacts of them relate back to the programme board. Obviously, there are decisions taken out with those structures appropriately so. The Auditor General said that significant decisions were made out with the programme governance structures. Are you telling me that that is no longer happening? I am confident that that is no longer happening. Just in follow-up to Ross Thomson's question, you confirmed that there is a live police investigation going on about this previous issue with contractors. Is that correct? Yes. Are you confident that there are measures, governance arrangements in place that we do not, in the future, have to have contractors taken on by the Scottish Government under police investigation and fraud teams involved in that as well? That frankly seems extremely worrying. Yes. That goes back to our earlier conversation. We cannot talk about it in detail because of the nature of the investigation. We have a whistle-blowing policy and we have strengthened it in relation to this and particularly in relation to arms-length organisations, particularly contractual bodies. First of all, I mentioned earlier that the issue of payments should find being levied for the result of late payment. Can you give an assurance that that is not going to happen? We are not going to be fined for late payment of the current run of payments? I shall ask Ellen to talk a little bit about where we are in the cycle because we do not know yet. I would like to feel that, as we said earlier on, we can give as much confidence as we can to our delivery performance. There will be some audit work and there will be conversations as well because it is not just to do with us, it is also to do with the system that operates across the whole of the UK in terms of fines and late payments. We are as confident as we can be, but I cannot give you a category assurance about that. I would be foolish to do so. I do not know if Ellen will want to say something about where we are and when we are likely to know in response to the root of your question about whether or not there may be some penalties or late payments. As the committee is aware, the normal period for payment is to the 30th of June, and between the 30th of June and 15th of October, in a normal cycle, there is the ability to make payments within that period. For this year and only for this year, the penalty-free payment was extended to the 15th of October. By 15th of October, Scotland had paid by value 99.9 per cent of all our cases. The 0.1 per cent that we did not pay at that time—the 46 cases that were outstanding at that time—will be disallowed on the basis of them. That happens every year. We get disallowed between 1 and 2 per cent every single year, I understand. The position in terms of penalties is not clear yet because it is a member state issue, not a Scotland decision. We are currently working with the UK co-ordination body to make sure that we have the final and accurate information on the basis of—and it is quite a complex—calculation about what progress has been made by the 30th of June and 15th of October, and whether or not the European Union will determine that there are any fines to be made. We are not at that position yet. We do not have the final information across the floor on parts of the United Kingdom. Do you have any idea of how much that fine could be? Or have you made provision for if the worst happens? We have done some estimates of what the worst-case scenario could be, but it depends on a number of factors. It depends on whether Scotland is liable jointly with England or with other parts of the UK. Of course, it depends on the progress made by other parts of the UK in terms of all payments being made by the end of October. If you want to know the number, the estimation is that the maximum penalty would be in the vision of about €5 million. Sticking with fines and sanctions, you talked about this data protection issue. It is not particularly within my ken, but I think that there is a possible sanction of £0.5 million for breach of data protection. Is that correct? If so, what is the risk of that attaching to this breach in your view? Ann Moise is a person to talk to on that subject. Yes, there are quite significant fines that the information commissioner can award. This particular breach was of email addresses and email addresses only. It is personal information, but it is not the type of sensitive personal information that the information commissioner has historically awarded fines for. That tends to be things such as large breaches, where names, addresses and particularly financial information are shared inappropriately or hacked. A talk-talk type scenario is not a case where email addresses have been shared inappropriately. It is highly unlikely that there would be a fine coming from the information commissioner's office in this particular case. I would not like to prejudge what his office will say, but it is more likely that it will ask us to ensure that our data protection training is completely current and that we have put processes in place to minimise the likelihood of anything like that occurring again. There has to be an argument that this is sensitive personal data. In so far as, yes, okay, it is names, email addresses, but by definition it discloses that these are people, if I am understanding you right, or businesses, who are in a situation where they are required to apply for loans. The data handling issue is with respect to farmers who have applied for the beef efficiency scheme, which is one of the cap pillar two schemes, so it is completely separate from the loan scheme. There has been no data issues at all that we are aware of on the loan scheme, and it is not also the classic, it is not the 18,000 population of farmers who are applying for basic payments. It is a category of farmers who have applied very explicitly for the beef efficiency scheme, and it is limited to those. But just one final thought on why has it taken this, given all the problems that have been going on for three, four, five years, why has it taken such a significant data breach to instigate the training? The training has been a requirement for all Scottish Government staff for a significant number of years. In fact, it was introduced shortly after the large inland revenue data loss some years ago, so it is a standing requirement on Scottish Government staff to refresh their training on data protection every year. But then it does not work, does it? Because there has just been another breach. What lessons have actually been learned from your previous event? With respect, you said right at the start that lessons have been learned, and I suggested that it may appear that lessons have not been learned. Is this not another example? Part of my investigation into what has happened in this will be to determine whether or not the individual or individuals involved have done their mandatory annual training. As I said, the email that I sent to all staff this morning was to remind them of the requirement to do this and to make sure that everyone who has not done it this year does it this year by close of play tomorrow. However, part of my investigation into what has happened is to make sure that we are to find out whether or not the individuals involved have done it. If they have had the training and it has not been successful, then what further training requirements do they have? I would like to go right back to the start. At our last session—forgive me, I have a lot of paper in front of me—Liz Ditchburn very helpfully explained about the new cap policy and how that worked and the regulations that came from the commission. Jonathan Price explained, and I quote from our official report, that we had concerns about the complexity, and we discussed all that, but at the end of the day we still went for three payment regions. He also explained that the Welsh and the Northern Irish use a single region. At what point did you realise that using the three-payment region was going to cause such problems? Was it too far in to change it at that point? Clearly, I was not around at the time when I settled on this role, but I was not involved, but I do know that it was discussed and the risks that were associated with the Scottish policy response to the EU regulations—namely, to go for three—were discussed. They were discussed in the team that was responsible, and they were discussed with ministers. Indeed, they were discussed with stakeholders. It was from the early stages of taking that decision, or prior to taking that decision, that the risks associated with this were flushed out and were understood. In hindsight, did we actually know at that time the level of risk that this would expose us to? Graham Dixon, who was the previous accountable officer, was in front of the PAC just over a year ago, and he had been in front of the PAC the year before, acknowledging that not knowing what the scheme might entail meant that there was an underestimation of what it would cost, the IT system would cost and the complexity that it was going to have to deal with. However, there was an awareness in all parts of the involved parties of the level of risk. There may have been an underestimation of how that risk might play out, but it was acknowledged. I was quite interested to hear the answer from Nicola Richards about the staff to Ross Thompson's question. I find it reassuring, but it is almost quite unbelievable that staff are saying that they are happy with their workload given the amount of extra work and extra pressure and stress that this has undoubtedly caused them. The staff on the front line in the area offices have had to deal with a lot of angry farmers, and obviously with the mistakes that we were hearing about, it has put a lot of pressure on them. Can you tell me if there is any extra support or advice or anything extra that you are offering the staff in these stressful times? Liz may want to come back in terms of the risk point that was made, but I will answer your second question, and Nicky may want to come in on that. There are two levels of support that are available for staff who are encountering, and many do, given the nature of public service and the nature of what the Scottish Government does. The two levels of support, one is at the corporate support. There is a Scottish Government wellbeing policy, there is employee assistance service, we put in a customer helpline to try and mitigate a little bit the pressure that was being placed very much at the front line and the front line staff. Staff also locally have monthly conversations with their line managers. In fact, the people survey tests how many of those monthly conversations are taking place and how useful they are to staff. Clearly, there is a pastoral care and all our managers, particularly those at deputy director and director level, are acutely aware of the importance of getting out, hearing from staff, trying to resolve barriers and irritations that often make the difference between work being stretching but enjoyable or feeling quite differently. I am encouraged by what I am reading in these survey results, but I am not complacent about it whatsoever. We have to understand that it only takes one or two people in a team who feel very much at the edge or very stressed about their work to actually change the culture. Before I hand over to Nicky, it would be one thing that I would say that we have really learned about this. We have talked about the technical aspects, we have talked about the contractual and the skilled aspects, and we are absolutely right. There is a cultural issue here as well about how we manage these kinds of big operational front-facing delivery programmes, which is very relevant to the social security one, but we are moving increasingly as a Government into direct operational delivery functions of the kind that one sees regularly in Whitehall but has not been quite so to the fore in Scottish Government terms. It is part of my responsibility to make sure that some of the changes I am introducing in how we introduce talent and how we skill up people, that it reflects that shift in focus and that shift in responsibility and the outward focus. I do not know if Nicky wants to say anything more, we may be short of time on the people side. Do you want to add anything, Nicola? I did not know if Eleanor had anything, particularly for the... Is it additional information? Yes. It is just to say that in relation to the People's Survey results this year, I have already started, engaged all staff across the directorate in a conversation about what it is that we need to do, what they want us to do, what we can do together to make this a better place to work, make them feel happier in what they are doing and feel more supported. Those conversations have already started. Finally, convener, the next time the Auditor General comes in to do an audit report on the CAP programme, can you reassure us that it will be better than this one? I think that it will record improvements that have taken place since the last meeting. Just one final question on management. Eleanor Mitchell, you said that there were 20 vacancies in your team that you had to fill. That is a lot at quite senior levels, is that correct? No. A number of vacancies were regular vacancies that come up every year because of staffing in area offices. I was referring to the area office staff and the jobs that we are filling in reflect to the new workload. Okay. Your predecessor was Jonathan Price. Is that correct? He came to give evidence at the committee 10 weeks ago. I think that you have been in post 11 weeks. Was Jonathan Price no longer working for the Scottish Government when he came to give evidence here? Let me clarify. He had already moved posts and we did inform through the clerk that we informed the committee that Jonathan was the most, in our view, Jonathan was the most appropriate person to come and give evidence at that time because he had all of the knowledge but we did inform the committee that he had already just moved on to a new post and that his successor was in place but we felt appropriate to ask her to come to the committee at that time. He is elsewhere in the Scottish Government. He is elsewhere within the Scottish Government. Okay. I thank you for your evidence this morning. As Gil Ross said, there are huge issues here. Police investigation, fraud team, overspend, errors, potential fines. I wish you all the best of luck in making the progress that we need to make on this so that we do not have this situation again. I am now going to move the committee into private session.