Good morning and welcome to the ninth meeting of the Public Audit and Post-legislative Scrutiny Committee in 2018. Can I ask everyone in the public gallery to please switch off their electronic devices or switch them to silent so that they don't affect the committee's work today? Item 1, decision on taking business in private. Do we agree to take items 4, 5 and 6 in private this morning? I agree. Item 2 is the 2016-17 audit of NHS Tayside. I'd like to welcome our first panel Fyonah Mitchell-Knight, assistant director of audit, Claire Sweeney, associate director and Bruce Crosby, senior audit manager from Audits Scotland. I'm going to invite Colin Beattie to open questions for the committee. Auditor General, in the past I've raised the question of the capability of internal audit and the appropriateness of it in its present form. Here we seem to have another problem with internal audit and we've got a history of this. We've had NHS Grampian, NHS 24, we've got NHS Tayside, we had Coatbridge College, we had Edinburgh College, where they seem to do their job but they don't pick up what's necessary. Is there a problem here? I think in this case Mr Beattie it's premature to conclude that the problem is with internal audit. The evidence that's available to us so far, and clearly the investigation is still under way, is that internal audit did raise concerns about the retrospective transaction on the endowment fund, which is I assume what you're referring to. That concern wasn't acted on by the trustees of the fund at the time. We know that the Scottish Government has asked Grant Thornton to continue its investigative work to look at this particular transaction following on from the work on eHealth funds that you took evidence on before the Easter break, and I prefer not to comment on the role of internal audit until then. I think it's clear, though, that there was a breakdown in the governance more generally, and I'm looking to see what advice the trustees took before taking their decision about the use of endowment funds back in 2014 before I draw any conclusions about that. It's clearly not just a question of the endowment funds. The question of the eHealth funds raises questions about internal audit. For example, Leslie McClay, when she appeared as a witness, said that she wasn't aware that the eHealth funds were within the deferred expenditure, and she hadn't asked because there was never any risk identified to her or the board. She went on to say that, as she said, we rely on internal audit to review our allocations, and there was never any risk identified that there were inappropriate allocations coming into our board. Was her expectation reasonable? Should she have expected internal audit to be able to alert the board? Her expectation was clearly reasonable. The reason that I'm pausing before drawing the same conclusion that you are is because the Grant Thornton review was very clear that the allocation letters which go from the Scottish Government to each health board with the allocations didn't make it clear that these funds were either ring-fenced for eHealth purposes or were repayable in the following year. Without that clarity, I think it's difficult to see how internal audit could have raised it as a risk or how the board members could have known. The Grant Thornton report makes it clear that the former director of finance was aware of it, and that the director of finance within NSS arranged for the allocation changes to go through, but that the conditions around allocation for eHealth moneys weren't clear on the allocation letters, which would be the basis that internal audit would look at, as well as the basis for external audit to make sure that the revenue recognition was accurate in the annual audit of the financial statements. Are you aware whether internal audit reviewed the contents of how the deferred expenditure account was made up, what the component parts were? I'll ask Fiona and Bruce to pick that up if I may. From an external audit perspective, there are two issues with the deferred expenditure. There's about the accounting and the financial sustainability angles. From the perspective of the accounting, the deferred expenditure is included in the board's income in an appropriate way and in compliance with the accounting rules. We're satisfied that that was the case in 2016-17, the period that we've carried out the audit. The bigger issue is about what that means for the financial sustainability of the board in that they're relying on non-recurring funds. Both us and internal audit have reported on the risks that that brings to the board, their reliance on non-recurring funds. Indeed, that was included in the Auditor General's report to you that was discussed in October about those risks. Just turning to the endowment question, do the internal auditors receive copies of the board minutes? The board minutes or the fund minutes? Either. The board minutes, certainly. The fund minutes, I would assume so, but I think Bruce will be able to confirm that for you. Yes, as I've understood, they do receive the minutes from the fund as well. So the internal auditors were received the minutes of meetings in which this was discussed and in which the action was taken that we're now aware of. Would they not reasonably have read this and said, this is a problem? Internal auditors raised their concerns about the retrospective transaction back in 2014, and it is included in the external auditors report as well, both in the body of the report and in the executive summary. So this has been in the public domain for some time. The question which I think is now of concern to us is the advice which the trustees of the fund took before approving the transaction that they did, but there was disclosure in the annual audit report and as a result of the internal auditor's involvement in the governance statement of the board's annual report itself. I'm just struggling about with the concept that all this has been in the public area, the public arena, and nobody's really picked it up. You say the internal auditors raised it as an issue, presumably they raised it to the board. The board itself actually was part of the problem if you like. How does this work? I think it's a very good question Mr Beattie. As you say, this was raised in 2014 by internal audit and by external audit. I have reported on the financial pressures and the financial sustainability of NHS Tayside to this committee each year for the last three years on 14, 15, 15, 16 and 1617. In my annual overview reports I've been highlighting the perverse incentives, the very narrow focus which health boards are taking to land on the revenue resource limits each year rather than their broader sustainability. So there is I think a significant question about why throughout the NHS system warnings from auditors are not being taken seriously, but the reason why is something that I think you would need to ask of people in Scottish Government and in the board itself. Now the external auditors presumably look at all the reports and so on from internal audit. They work closely together. The external auditors, what did they do when they saw this transaction? I think it's important first of all for me to be clear that the external auditors don't audit the endowment fund. The endowment fund appoints its own auditors and they're not within my remit as auditor general. Of course. There was evidence from internal audit of a concern. The external auditor surely would have picked that up and developed it. They did.  So I appoint an auditor to the board. The endowment fund appoints its own auditors. Since 2014, the accounts of the endowment fund have been consolidated within the accounts of the NHS board because of the degree of overlap between them in later terms. You're probably aware that the trustees of the endowment fund are the members of the health board appointed by the cabinet secretary sitting in a different capacity, but they're the same people sitting with different roles. So the auditor of the health board in order to carry out that consolidation issues a questionnaire and instructions to the auditor of the fund, which asks them for a number of pieces of information about the board minutes, the significant transactions that were taken, any unusual transactions, and as a result of that included in their annual report for 2014 a very clear statement about the retrospective transaction and the extent to which the board had relied on transfers from the endowment fund during 2014 in order to balance its books. That was the first year in recent times that NHS Tayside has required brokerage and this was part of the same picture. But because they're not the auditor of the endowment fund, it's not their responsibility and indeed they have no locus to look at the advice which the endowment fund took before approving that transaction. That's a matter for the auditors of the endowment fund and indeed the trustees of the fund who've got very specific responsibilities under the charities regulations for acting in the best interests of the fund and I understand that's what the review that Oscar are currently carrying out will be exploring. I realise that obviously the endowment fund itself doesn't fall within the audit programme but I would say again internal audit raised it. You say external audit picked that up and took action on it but here we are some years later and the problem just seems to have popped out and yet supposedly it's been in the public arena for some years. There's no supposedly about it. I've got the annual audit report here. It's been on our website and NHS Tayside's website since June of 2014 and it's very clearly reported in there. I think the issue that has arisen now is whether the board was acting properly as trustees of the endowment fund in approving that, the advice which they took and whether they were aware of the concerns which I understand the internal audit had raised at that point. As far as I know at this point there is no concern that the transfer was illegal. It was a regular transaction and the auditor reported it in that way as being something which is an unusual transaction which played into the growing picture of financial pressures at NHS Tayside. It seems to me that everybody claims they did their job and yet we are where we are. Is the audit function broken? Should we be investigating whether the way that we handle internal audit and maybe even aspects of external audit should not be reviewed? You won't be surprised to hear my view that this isn't about the effectiveness of audit. This is reported within the external audit report. The concerns were raised by internal audit. The question is why the trustees of the endowment fund didn't respond to those concerns when they were reported. I think that that is what Oscar is looking at. For me it raises a question about whether there is an inherent conflict of interest in the fact that the trustees of the endowment fund are the same people as the members of the NHS board. That's the question that was considered by the Scottish Government back in 2013 when it produced its guidance for endowment funds. It concluded that there was no inherent conflict of interest. I think that question is now back in play given what we have seen in Tayside, the concerns that are being raised and the question of whether, particularly in times when health boards are under financial pressure, trustees are able to separate their responsibilities as trustees from those as members of the health board. That's a fair question that, hopefully, Oscar will bring out in the report. At the beginning of my questions, I gave a list of failures in the audit system where problems arose that audit did not pick up either because it was not within the process or whatever. Is audit a chocolate fireguard here? Not at all. It is important to be clear what audit does. Audit doesn't substitute for the responsibilities of management and board members charged with governance in making sure that they have got proper checks and balances in place, that they follow the corporate governance requirements that they comply with the Nolan principles. It does provide a way of, for external audit, reviewing the extent to which those checks and balances are being applied and reporting that to the appropriate body. In the case of the bodies in my remit, it's this committee, which is why we've been discussing them. Auditors don't have stop powers. They can't stop people from doing things that they think are inappropriate. The power that we have is the power of public transparency and exposure. I think the fact that we're discussing these things is a marker of the system working, not of it being broken. Just one last question. Are you satisfied that, given the scale of the financial issues that we're facing in NHS Tayside, no undue pressure was put on the internal audit at any point to go easy on any of the audit processes? I can't give you that assurance. I know that, in the case of the endowment fund transaction, those concerns weren't listened to. I don't know what pressure may have been applied, but it's a worthwhile question to ask. Auditor General, to follow up on Colin Beattie's line of questioning. The day this issue about the endowment funds came to light, it was a story in the Herald written by Helen Macardill. She said, internal auditors from NHS Fife and Forth Valley questioned how endowment fund cash was being used, but were warned that they risked losing their contract with NHS Tayside unless they backed off. What is your reaction to that? I've seen the press coverage as well. It obviously informs my response to Mr Beattie's question. I don't have evidence either way of whether they were put under pressure or not. I expect that that's one of the issues that the second phase of the grant Thornton review will explore. I think it's worth noting that it is one of the differences between internal and external audit, certainly in the Scottish public audit system. Internal auditors are either appointed by or a part of the body that they provide services to. External auditors are appointed by me to bodies in the health service and the other bodies that I have responsibility for. That means that that sort of pressure can't be applied in the external audit world in the same way that it potentially could be in internal audit. I think that's an important distinction. If that were true, what I read out, a take-at-you would see that as unacceptable? Completely. Internal audit is there to provide assurance to those charged with governance. It's intended to have a degree of independence to report directly to the audit committee, not simply through the chief executive. While there's always a discussion about the factual accuracy of an issue, at the end of the day it's for the auditor internal or external to make their judgment and to report it without fear or favour. I'd like to follow up on some of Mr Beattie's other questioning. In your opinion, the trustees of the Endowment Fund NHS Tayside, did they comply with the Nolan Principles at that meeting in 2014 when they suspended the constitution? I think that it's premature to conclude that they didn't. I know that there's been a lot of concern raised publicly about the fact that the funds were spent on a computer system. Actually, if you step back and look at the purposes and charitable objectives of all of the Endowment Funds, they are quite broadly drawn. They're about providing support for health services and they're very close to the objectives of the NHS in the same legislation, the NHS Scotland Act 1978. The guidance that was produced in 2013 by the Scottish Government adds a proviso which says that trustees should be careful that they're not substituting for core health services. Clearly, that comes into play in what we currently know about the retrospective expenditure on IT systems. I think that the other concern that I've got is that it was retrospective rather than being part of a planned programme of expenditure of Endowment Fund moneys. The review that Oscar Carying out will look at whether, for example, the trustees took their own legal advice separate from that of the board about the use of funds for this purpose and the question that we've just been exploring about whether they took advice from their internal auditors in the way that I would expect them to do. That Oscar report, I don't think any of us are all that clear of when we expect it to report. Do you know when it's expected to report? We have a letter here from David Robb and I'll ask one of my colleagues to check if that contains a date. I think that it probably does not have an explicit target date in there. I don't think that it does, but maybe we can check that after. On the Endowment Fund trustees, you said that it's an open question now of whether the Endowment Fund trustees should be the same people as board members who are under pressure to reduce a deficit or to balance the books. In your opinion, as auditor general, should there now be a separation between Endowment Fund trustees and board members on health boards? I think that that is a matter for Oscar and for the Government, but my view is that this case shows the risks of having the two sets of individuals working in two separate capacities at the same time. I think that in theory it's easy to agree with the conclusion reached in the Government's 2013 guidance that with proper processes there need be no conflict, but I think that when we are in a situation where all boards are under significant financial pressure it's difficult to maintain that separation in practice. Do you think that 2013 guidance is good enough? Some trustees tell me that presented with these decisions on whether this is charitable spending or core funding, sometimes it's very difficult to make that call. Do you think that 2013 guidance is strong enough? I would completely agree with trustees that it is hard to make that call. I've said that the charitable purpose and objectives of Endowment Funds are in many ways exactly the same as those of the NHS, so it's not the case that Endowment Funds are only there for the extras or for patient comforts or the sorts of things that people might assume that they're there for. It's very common, for example, for people to make a donation for a specific piece of medical equipment in the past. We've seen them funding things like MRI scanners, so it's not an easy separation to make, but I suspect that's another reason why it might be worth reconsidering whether the trustees should be different people from the board members, or at least have an independent element within the make-up of the board of trustees of the fund. Auditor General, I understand from the press coverage that there was, and correct me if I'm wrong on this, £4.3 million transferred from the Endowment Fund to NHS core funding, but £2.71 million was spent. The cabinet secretary and the new chair of NHS Tayside have said that the Endowment Funds will be paid back. How much money would you expect to be paid back? Is it the £4.3 million that has been transferred or the £2.71 million that was spent? The amount in 2014 that was funded retrospectively on projects that Tayside health board had commenced was the £2.7 million. During the year, the amount transferred was larger, and I don't know how much of that was spent or not. I think that it's worth being clear, though, that we've been following closely events in Tayside, including the board meeting last week, which agreed to repay the money to the Endowment Fund. Fiona, as the auditor of the board, has asked them for a range of information, including the legal advice that they've taken about their ability to make that transfer from health service funding into the Endowment Fund, the specific status that they're relying on and the process things like the paper that the board considered and the minute that they've taken. We're still considering how that transaction can be made in a way that fits with the board's own powers and responsibilities. I'm just not 100 per cent clear, because if the £4.3 million has been taken from the Charitable Fund and put into NHS Core funding, people who have raised this money and given so generously would probably expect the £4.3 million to be returned and not just that that had been spent. Is that what you're saying should be transferred back? That's why we're looking to see the board paper that was considered and the legal advice that the board took in considering that. At the moment, we don't know that. Fiona and Bruce weren't at the board meeting last week. We haven't yet seen the board agenda paper and the minute which explored what would be the proper course of action for the board members to take at this stage. Okay, that's something we can come back to. Liam Kerr. Thank you, convener. Good morning. We looked last week in some detail at the undetected e-health funds. This was £5.3 million that was obscured to use Paul Gray's language in the accounts. Last time we looked at it, Leslie McClay stated that she wasn't aware of it. The former chair, Professor Connell, said that the £5.3 million had been broken down into chunks that were almost de minimis, so they wouldn't be picked up. So the question is, would you have expected to see a higher level of scrutiny by either the management team or the board in those circumstances? I think that I would expect two things that don't seem to have happened here. One, the allocation letters that went from the Scottish Government to the health board to be clear about the purpose of the funds that were being transferred and any conditions attached to them, including whether they were intended for the benefit of boards other than simply Tayside and whether they were due to be repaid in the following financial year, both of which seem not to have happened. I would expect the director of finance who holds a very significant and responsible position within the corporate governance of the board to be making that clear to the management team and to the board as part of the financial reporting. Neither of those seemed to have happened on the basis of the report that Grant Thornton of produced so far. We'll come back to the director of finance shortly if I may, but before that we heard quite a lot of evidence around how difficult it might be to pick up these funds within the accounts, so can you just make clear, should the management team and the board have detected those funds, is it possible for a board to do? Is it possible for a management team to do? I think it would have been hard to do given the lack of detail, the lack of information included in the allocation letters. I'll perhaps ask Fiona and Bruce to tell you more about what they see as they carry out the audit, given that revenue recognition is one of the significant risks that any auditor has to look at as part of their work. The accounting rules on income for boards say that the income that is included in the board's accounts should agree to that that is seen in the Scottish Government funding allocation letters. Those funding allocation letters are our prime source of evidence for looking at what income should be included in the accounts. For the audit of 1617, we checked those letters into the accounts and indeed the letters do not say anything about any of the funds not belonging to Tayside nor do they mention any requirement for them to be repaid, so there was no way that we could identify from the letters that that was the case, nor could we expect the members of the board, the management team, to identify it either from those specific letters. We, of course, were not aware of the discussions that were ongoing behind the scenes between the directors of finance and the health group, which is discussed in the grant thawnt, and we hadn't seen any of those emails or any other evidence that would lead us to question anything that was shown in those allocation letters. Are the allocation letters an unusual drafting, if you like, of the allocation letters, or is this a structural failing that needs to be rectified? I think that it's a structural failing. I've reported in my annual overview reports across the NHS since 2012, when I took up this job, that because of the narrow focus that boards have on hitting their financial targets on 31 March, there are an awful lot of changes to the allocations that boards get during the year and, indeed, after the end of the financial year for different purposes. There's an underlying concern there that it's not easy for a board to know how much they've got to spend potentially until after the financial year end. In this particular case, we know from the grant thawnton report that it suited both NHS and NHS Tayside for allocations to be moving in this way. The directors of finance of both bodies appear to have been aware of that because it removed a surplus from NHS national services Scotland to NHS Tayside, which helped to reduce the deficit that NHS Tayside had, but because of shortcomings in the way that the allocations were managed, that wasn't apparent to anybody else except the directors of finance in those organisations and potentially a small number of their more junior team members. Would a differently constituted board potentially have picked this up? Let's say, for example, my understanding is that the board of NHS Grampian seemed to be performing rather well, hence one of the reasons why we've got some changes going on at NHS Tayside. Might their board have picked this sort of thing up? Would a high-performing board have picked this up? As Fiona has said, it would be very difficult for any board to do it if they were being misled by their director of finance. The director of finance holds a very significant responsibility. They have professional and ethic responsibilities by merit of being members of their professional accounting bodies. They have personal responsibilities in relation to the corporate governance code and the financial reporting manual. If they are not making that information available to board members or to management team members, it is difficult to see how the board can be expected to overcome that. The director of finance, I am going to recite the narratives that I am hearing at this side that I heard last week. You have just talked about being misled, or the board was misled by director of finance. Paul Gray talked about deliberate obscuring. The narrative that I am getting, and the thing that does not quite make sense, is that the then director of finance was long-serving. I think that he had been there for about 35 years. He was very senior, very experienced, very close to retirement and yet, without referral to his colleagues, including a CEO and former CEO, whom he had worked with for a long time, he apparently deliberately obscures this transaction, a process for which he derives no financial benefit himself, a process that delivers no benefit to NHS Tayside, because we heard from Paul Gray that brokerage would have been extended and there would not have been a problem with that. So nothing is apparently achieved. Effectively, the FD goes rogue for no reason. Is that credible? I cannot clearly speak for the motives, the rationale for the director of finance's behaviour, and indeed all I can go on is what is in the public domain, both in relation to the e-health moneys over the last few weeks, but also going back to 2013-14, when auditors first started in the time that I have been in the role here, raising significant concerns about the financial pressure that Tayside was in. I think that Tayside first received brokerage in 2013-14. That is not terribly unusual. A number of boards require brokerage from time to time, but since 2013-14, Tayside has received brokerage every year and needed it and has been resorting more than most boards to short-term measures to bring its budget into balance at the end of each financial year. I think that it is important to be clear, as I have said in my overview reports every year since I have been in this job, that NHS boards take that responsibility very seriously, the need to balance their budget almost to the penny at the end of March each year, and that in my opinion that gets in the way of more strategic, more important, longer-term financial planning that would help to address the underlying causes of some of these pressures. However, I think that it is that climate that may help to explain the actions of the director of finance rather than any sense of personal gain. I think that it is the premium, the focus that is placed by the Scottish Government and more generally in the public debate about health boards balancing their books rather than having a sustainable financial strategy for the longer term. I appreciate that it is a difficult question to answer, but is it credible that the director of finance did all of this and did not at any stage say to anyone else in the organisation that this is what I am doing to achieve the endgame that we require? Do you think that that is credible? That is a very broad question. Again, it is difficult for me to comment on people's motivations or what may have been known. What we do know, for example, around the e-health funds, is that it would have been very hard for members of the management team or the board to have been aware of what was going on. Auditors do see revenue recognition as being one of the key risks that they plan their audit work around each year, and they look for evidence to make sure that the income is properly stated in the accounts. Individual auditors and I at a national level have been reporting for five years now about the measures that people take right across Scotland to balance their books in terms of deferring expenditure, of making non-recurring savings and, from the Scottish Government's point of view, of redistributing money through late allocations to bring boards into balance. All of that means that it is possible that the way in which a relatively small amount of money—let's not forget that in 2016-17 the amount of e-health funding involved was £2.6 million—may not have been apparent to more senior people in the organisation. I do not know whether people who were more junior within the finance team knew about it, but I suspect that they may not have understood the significance of it or have had the whole picture to see it in that way. You have referred to the behaviour of the former director of finance. Do you have any evidence that he did not share this information about the e-health deferred funds? Do you have any evidence apart from what we heard from Paul Gray and Leslie McLeod at the last committee meeting? The evidence that I am founding on is the report that was commissioned from Grant Thawnton to explore the specific issue of e-health funding, where they reached that conclusion very explicitly in their report. When you reached the conclusion that the director of finance had not shared this information, I think that the way that they phrased it would have been very difficult to see how other members of the board could have been aware of it, but the report again is available to the committee. Clearly, the committee has a concern to try and get at whether this is a problem with the behaviour of particular individuals in the NHS, Tayside, or particular elements of governance in the audit committee, or the finance director, as Mr Kerr was asking, or is it a problem to do with NHS Tayside, or is it a problem to do with the wider NHS system? Is it fair to say, Auditor General, that what you suggested in your previous answer was that what happened here was not an attempt at personal gain by anybody, but perhaps an act of desperation to look as if a budget had been balanced which it was impossible in fact to balance? Is that reasonable? Yes, I am very clear that there is no question of personal gain in this. I think that it is difficult to understand it without understanding the context of general pressure and concern to deliver a balanced budget within each health ward across Scotland, and a situation that we should have been building since at least 2013-14 of that being increasingly difficult to do. Set that alongside what we now know as shortcomings in the process by which the Scottish Government allocates resources to individual boards, my sense is informed by the Grant's London report that the director of finance at NHS Tayside was able to use that to make the position appear better than it was. You said again there, as you have previously, that you talked there again, Auditor General, about measures to balance the boots in order to meet the short-term requirement to balance the funds across boards across Scotland. Those pressures, which perhaps we can surmise have led to the behaviour in NHS Tayside, are prevalent in other boards across Scotland. That is true. I have been reporting since I took this job that although I think in 2012-13, which was the first year for which I had responsibility, almost no boards, I won't say none, failed to meet their resource limit targets. That was done at the cost of an awful lot of short-term measures like deferring expenditure, like late allocations, like finding non-recurring savings, which gave the appearance of a balanced budget but actually did not address the underlying problems. In response to Mr Beattie earlier, you said, throughout the system, auditor's warnings are not being taken seriously. Throughout the system, you meant across the NHS, across Scotland? When I said that I meant choosing specifically, I meant that in NHS Tayside, those warnings have been sounded since 2013-14 very clearly. In relation to the system as a whole, I have been saying this since I took up the role in 2012 about the pressures on the NHS beyond that. The overview reports contain information about the measures being taken at other boards, but I would prefer not to be specific about those without referring back to the factual content of the reports. Is it fair to say that NHS Tayside is the canary in the coal mine? This is the place where the pressures have led to the problems that we have seen under now dealing with and which the health secretary has had to deal with by using her special powers. Is this an indication of problems that could potentially arise elsewhere? I do not think that it is straightforward to draw that direct line of conclusion between the two. We know that there are some particular circumstances in Tayside that have made the pressures more acute on them. The committee has taken evidence on that on a number of occasions over the past couple of years to do with their expenditure on drugs, on agency staff, on the property portfolio that they hold. Equally, I have reported over the past five years on the extent to which most boards are relying on short-term measures to balance their books. Can I begin? The issue of the e-health money and the endowment funds are two separate issues, clearly, in two separate sets of circumstances. Starting off with the e-health money, clearly, what happened here appeared to be as a result of a deal done between the finance director of NSS and the finance director of Tayside health board. Neither of whom we are going to gain has been said on a personal basis. It was to try to shore up the appearance of robustness in the Tayside health board budget, and it solved the problem for NSS because it did not appear with a big surplus at the end of the financial year. Are you sure that similar deals, either in relation to e-health money or in relation to anything, have not been done with similar impacts in terms of covering up what is actually going on in the financial system and the health service between NSS and other territorial boards or, indeed, between any of the non-territorial boards and a territorial board? In other words, having been a health secretary, it is difficult to believe in knowing how those bureaucracies work. I find it hard to believe that this is a one-off deal. At this stage, I do not think that I can give you that assurance. As you can imagine, the Auditor of NSS will be looking closely at the other special-purpose funds that it manages and distributes, and the Auditor of the Scottish Government will be looking at the way in which the health directorates are looking to improve the allocations process and to understand what may have happened under the process as it has stood up until this point. I think that it is, though, part of this wider question about the pressure to meet short-term targets rather than to manage long-term sustainability. What I would like to see is moves in the Scottish Government and in individual health boards to shift the focus away from how much do we need to save to hit our revenue limit on 31 March to do we understand our finances over the next five years, the next 10 years and what measures are we taking to make sure that they are sustainable? When will that work be complete? When will we know as a committee that similar deals, possibly covering other boards, territorial and non-territorial, possibly covering other issues other than e-health, possibly including other e-health deals, when will we know the results of that work? I know that the NHS director of finance is carrying out her own review at the moment as a matter of urgency to look at these other funding streams and to look at the way in which the allocations process can be tightened. It is an issue that we will pick up as part of the annual audit for all of the boards that I am responsible for for 2017-18, and the audits are due to be completed by 30 June, but there is obviously a bit of interplay between those two processes. There is obviously a very specific issue as to whether similar deals have been done across the board. It seems to be inevitable that there will be other deals that have been done that have so far not come to light. I do not believe, as a former health secretary, that this was a one-off deal. As I have said, I have reported over a number of years that we have seen these late allocations being used for purposes that appear to have the primary rationale of levelling out underspends and overspends between boards. We know that it has happened. The question that needs to be answered is a slightly more difficult one, which is whether there are any hidden streams of funding that are small in relative terms but significant in absolute terms, and uncovering those, I think, may take a little bit longer. Both we as auditors and the NHS Director of Finance are looking at that as a matter of urgency. When you say the auditor of NSS or the Scottish Government, can you actually say who that is rather than just the auditor? Yes. As you know, I appoint the auditors to all of the NHS bodies. In the case of both the Scottish Government, I sign the account myself and I appoint a lead auditor to undertake the work on my behalf. NSS is also audited by an assistant director from Audit Scotland. In fact, it is the same person as the person who leads the Scottish Government audit, so there is a good degree of interaction between. Can I just go back to NHS Tayside and ask about the interim arrangements? First of all, I have the highest regard for Malcolm Wright, who is one of the best officials that I ever came across in Government anywhere, so let me say that. Absolutely. I have total confidence in him as a very competent individual. Malcolm is currently chief executive of the northern region of the national health service. He is also currently the chief executive of Grampian region, a Grampian board, not without its own other difficulties. Now that he has been appointed as acting chief executive of Tayside, how on earth is he going to have any time to deal with the problems in Tayside when he is holding down three very important jobs simultaneously? I share your concern, Mr Neil. You all have seen, as I have, the information in Paul Gray's letter that there are arrangements in place for the deputy chief executive at Grampian to take on additional responsibilities in that board to free ups and time for Malcolm Wright to focus on NHS Tayside, but none of those are small part-time jobs that leave lots of time and energy for other things. I assume that the Scottish Government is looking to resolve the question of the long-term leadership of NHS Tayside quickly, and I think that that is the question that you would need to address to them. I again put the definition of quickly. I think that I have real concerns about this. I think that this requires somebody who has got no other responsibilities within any other organisation. The chief executive is the key person to sort out, and we are talking about this. This is all about governance. This is not a clever governance arrangement in my view. In fact, this is very high risk. I share your regard for Malcolm Wright, and I share your concerns about the stretch that this is placing on any individual, however competent and experienced. Secondly, the other interim arrangements, what is the current status of the former chief executive? My understanding is that Ms McLea is currently off sick.  I think that these are questions that you would need to direct to the Scottish Government.  The issue of also severance payment and all the rest of it comes up. So, from an auditor point of view and from a governance point of view, are you not concerned about this very unclear arrangement? I do not know the timeline of actions and events surrounding Ms McLea over the last few weeks since these issues have been in the public domain. It is important to say that Fiona Razd, the appointed auditor, will be looking at any severance payments that come up as a result of this in the course of her audit work. At the moment, we know that the former director of finance has departed. She will be looking closely at the decision making and any financial transactions around that. If Ms McLea leaves the board, the same will be the case. Of course, any auditor would want to comment on significant changes and potentially significant gaps in the governance arrangements for the body that they audit, without knowing more about the particular circumstances and recognising the sensitivity of that employment issue. I do not think that there is much more I can say this morning, but it will be an important matter for the auditors. Is one other related point in relation to the former chief executive? Obviously, when she became chief executive, she was then appointed as a director of the board. Has she resigned from or been dismissed as a director of the board because it is two separate processes? My understanding is that she would be a member of the board as the chief executive. I have not seen anything to suggest that she has been removed as a member of the board, and I think that it does come down to understanding very explicitly what her status is. My understanding is that she is on sick leave, but it really is a question for either the chair of the board or for the Scottish Government. To check the current situation, certainly when I was there, because I changed the rules, because the irony was that the cabinet secretary had to approve every board member except the appointment of the chief executive over whom at that time the cabinet secretary had no responsibility. I changed it because an appointment was made in one board that I strongly disagreed with. I indicated previously that I strongly disagreed with it. The board and the chair went ahead anyway, made the appointment, and then they asked me just to sign off this person then becoming a director, and I refused to do so until we changed the rules, and we changed the rules so that the cabinet secretary—because it is the most important board appointment of all the appointments, and yet it was the one that the cabinet secretary had absolutely no involvement in. We changed the rules so that the cabinet secretary had to approve the appointment as chief executive, but it was a separate legal process as to making the appointed chief executive a member of the board. I think that in all of these points, convener, we need absolute clarification from Paul Gray, because I do not want to see that as yet again in a position where a chief executive is told to stand down because of the governance situation and then can stay on full salary for a year or wherever before they leave the organisation. I do not want to get into personal issues, obviously. This is a governance issue, and I am addressing it as a governance issue. In all of these questions, we need immediate clarification from Paul Gray. I will be seeking that from Paul Gray, and we can discuss that after this evidence session. Thank you, Mr Neil. Can I follow up on one of those questions, Auditor General? The committee, well before my time on it, has been concerned for many years about severance payments in the public sector, and Alex Neil touched on that. We know about the financial mismanagement at NHS TSA. You have reported on it for many years now under section 22. In your opinion, should the outgoing chief executive receive a severance payment? I think that it would be difficult to justify a severance payment in the terms that you are intending, convener, but the committee heard in evidence from the former chair and chief executive of the board before the Easter recess that, actually, there was no severance payment involved, but instead the former director of finance chose to exercise his option to retire, given his age and standing with the board. That is very much the sort of territory that Fiona and Bruce will be exploring as part of their audit work, to understand the basis on which he left, to understand the basis of any payments that may have been made, and you have got my assurance that we will report that back as part of the reporting on the audit, which is due to complete by the end of June. With respect to the director of finance, we are in a current situation where we have a chief executive who we expect will leave the organisation, or the cabinet secretary said that her position was untenable and she has been replaced but is still an employee. Given concerns of public money around the severance payments in the public sector, do you think that it would be appropriate for an outgoing chief executive to receive a severance payment from the public part? It is always very difficult to comment on specific cases because there are both disciplinary potential implications to be considered and employment law considerations to be taken into account. What I would expect the board to do, and what Fiona will be doing as the auditor, is looking at the process that the board goes through in deciding how to give effect to the requests that the cabinet secretary has made in relation to the chief executive. There are clearly questions to answer here. Those questions, as far as I know, have not yet been answered and that would then lead on to a question of whether any severance payment were appropriate and how they were made. What I can do is to bring full transparency to that and to report to you any concerns that I might have about the way in which it is done, as I have done on a number of occasions in the past. Willie Coffey Thank you very much, convener. Just to ask a few questions that perhaps have not been asked yet in relation to the e-health £5.3 million. Do we know if that money was receded as a single payment initially or was it itself received as separate payments initially? Do we know that? It certainly wasn't a single payment and it wasn't a payment for e-health. It was an allocation from the Scottish Government to NHS Tayside, which didn't make clear what it was for or the conditions attached to it. Fiona? It came in in smaller amounts than a single £5.3 million transaction. I think my recollection is that it was split across four different transactions for 2016-17. That's not the full £5.3 million, but it was split up. It came in in smaller chunks initially. Through the allocation letters? Yes, it was split. Would it still have been described as the same thing if you know what I mean? Would it be terminology, the language, the allocation letters? They would describe it as… They didn't describe it as anything else. I think it's the problem. It simply described it as an allocation of funding to NHS Tayside rather than describing it as e-health. From Fiona? I think there was e-health in the description, but there was no indication that it wasn't any health funding due to Tayside. There was no indication that it was due to other boards or that it was due to be repaid, so descriptions are not clear. From that point onwards, there was a further process of splitting it up into even smaller units, which in the Mr Gray's words was a process intended to obscure the transactions. Did that take place? Or was it the amounts that were received in the small amounts, was that the small amounts that we were talking about here, or was it further dispersed and spread out through the year to achieve this effect? The allocation letters for 1617 were split into four transactions, and then that as a whole is included in the total income that is disclosed in the boards accounts. It's not actual money in your hand. It was an allocation against which the financial outturn is assessed for measuring whether they have achieved targets. Yes, I understand that, but what I'm trying to ask is, if it came in and say it has four payments, did it then appear in the accounts as 10 payments? Was it further divided to bring it under this million pound threshold below which people were unlikely to notice it? No, it's quite the opposite. It goes into the total income, which is the large numbers on the face of the accounts. So why didn't anybody notice it?  It was £2.5 million in 2016-17, and that was part of the overall revenue income of £803.2 million. And as Fiona has said, the allocation letters didn't make it clear that either it wasn't specifically for Tayside or that it was liable to be repaid in the following financial year. In terms of the audit process, there was some discussion convener about whether the audit process should or shouldn't have picked this up, and there's been some discussion about that. What do you think yourself here? Do we need a different process? I mean, it's one thing to say to the boards now, stop doing that, but it's another thing surely to make sure that it's not being done. If the audit process itself won't find this or reveal this, what is it we need to do to put in place to make sure this kind of thing doesn't happen? Is it an extra audit process or is it something else internal that needs to take place? I think that the root cause of this is the system by which the Scottish Government allocates funding to NHS boards. That is the prime source of income that they receive. It's important that boards themselves are clear what they're receiving, why and any conditions attached to it. The events surrounding e-health funding in Tayside have demonstrated shortcomings in that process. That's very clear from the Grant Thornton report. We know that the NHS Retrofinance is reviewing that process and we'll be looking closely as part of our audit of the Scottish Government to look at what changes they make to that and to what extent we think they're addressing the risks that have been identified here. I have time to ask a question on the endowment fund. Oscar in 2010 looked at the Lothian health boards in the endowment fund management and made some recommendations about the separation of duty in terms of the endowment fund boards as opposed to the board. Do you think that the guidelines on the recommendations made then were strong enough? Do we need to review that given what's happened with NHS Tayside? I think back to the earlier point that the Auditor General made about the need to review the guidance to see if it is clear enough. Auditors will check against the guidance to make sure that organisations are following the rules and if it is very difficult or if there is quite a lot of leeway or a degree of breadth around how they can be followed through locally, then that's very difficult for audit teams then to determine what does it look like when it's not fallen within those rules, if the breadth is quite significant and it's not very clear from the guidance. Part of the process that's happening now is a consideration about whether that guidance does need to be clearer and that will help the audit process in turn. Very briefly points of clarification if I may. First of all, the eHealth moneys, so £5.3 million, it's broken down into chunks below £1 million. Has anyone reconciled the accounts such that the allocation letter is matched to what was contained in the ledgers? That's a core part of the work that the auditors do in every health board. The allocation letters are the prime source of evidence for the income that the board has to spend, which is obviously a foundation of the audit work. The problem isn't that the allocation letters were wrong, it's that they didn't provide that information about the money being there for more than just TASIDs use and for it being repayable in the following financial year. That was opaque to everybody apart from the director of finance of NHS TASID and apparently the director of finance of NHS National Services Scotland. Can I just move on something that Willie Coffey asked about? Obviously we've heard about this deliberate obscuring. We heard that the funds were broken down into pots of less than £1 million so that an average board wouldn't pick them up. What I just heard from Fiona Mitchell-Knight was that, in fact, the sums came in and were collated into a big sum and therefore became much more obvious. Have I misunderstood something there? I think that what Fiona Mitchell-Knight was saying was that, let's be clear, in 2016-17 the amount involved was £2.5 million, as set out in the briefing paper that we've provided to you. I think that Fiona Mitchell-Knight was saying that that £2.5 million needs to be seen in the context of the £803 million of the overall revenue coming to the board in that year. The additional amount of money that brings it up to the £5.3 million was money that the board was banking on, was expecting to receive in 2017-18, so hasn't been part of the overall outturn yet or indeed part of the audit that is happening. I think that Bruce and Fiona are in a position to give you a bit more information about the way in 2016-17 the money was managed. The allocation actually comes into the accounts through the summary of core revenue resource outturn. That starts off with the net expenditure of the health board and then set against that is the amount that comes through is the gross allocation from the Scottish Government, which then we identify whether they've met their target of achieving their revenue resource limit. That only comes into the accounts in a single sum, and that's what we then check to the allocation letter from the Scottish Government. It's the resource accounting manual in the Scottish Public Finance Manual that requires us to do that to make sure that those two are in agreement. At no stage in the accounts does it split it down to any greater detail in that, so there would be no way that we would be able to evidence any of the amounts within that to a degree that you suggest that we could be looking at. Obviously, we've been concentrating here on the financial impact of these decisions, but the whole point is that eHealth money was designed to carry out specific initiatives in relation to eHealth, such as developing the electronic patient record and so on and so forth. The important point here that we haven't talked about is that, as a result of these deals, is the ministerial policy on eHealth being sabotaged in order to reach a deal to cover up a real deficit or a bigger deficit than appears to be the case? What have been the implications for government policy? One of my frustrations, particularly on eHealth, when I was a Cabinet Secretary, is that I felt as though, without having an army of people to double check, things were being delivered. In a lot of areas, it wasn't being delivered to the front end, and now I'm beginning to understand some of the reasons why. I think that we need to look at this from the point of view of that eHealth money was designed to do something to take forward the eHealth agenda, and clearly that didn't happen. I'll be brief, convener. You're absolutely right that that is, in many ways, the important question. I think that it's important to be clear that the reason why the money was available to be transferred to NHS Tayside was because of slippage on the eHealth programme. I think that it's a stretch to suggest that that's due to any attempt to sabotage the programme, but I think that it does demonstrate the difficulties in spending that money in ways that does achieve the transformation of the health service, which would be one of the solutions to the financial pressures that Tayside and other health boards are under. Do you suggest that the intention is to sabotage what I'm saying is that the consequence was effectively to sabotage the programme? It's due to slippage, there's no question of that. Of course, we have this bizarre situation where the eHealth monies were being used to deal with the deficit, and then charity endowment money would seem to be used for an eHealth project. Otis General, just on the deferred expenditure, the eHealth money, you heard me asking the former chief executive at our last evidence session if she should have been asking these questions about deferred expenditure, Ian Gray asked as well. In your opinion, should she have been asking those questions about what the deferred expenditure was and how much it was? Any chief executive and any board should be asking those questions, particularly in a context where we know that a lot of boards rely on deferred income and other short-term measures to hit their targets. Having said that, I think that it comes back to the point that the director of finance holds a very responsible, personally responsible position and has professional and ethical responsibilities. If the director of finance isn't providing straightforward information about those questions, it's difficult to know how the chief executive or the board could get beyond that in the absence of evidence that there is a particular problem. We know from the Grant Thornton report that that evidence wasn't apparent. We do think that it is a two-way street because the evidence that we heard would indicate that she was under the impression that it was a one-way street. She wasn't given this information and therefore didn't know about it. In your opinion, it is a two-way street. There are obligations on director finance to provide the information and obligations on the chief executive to ask those questions. Absolutely. It's incumbent on any board member, chief executive and other board members to ask the difficult and challenging questions. It's what they're there for.  Thank you, convener. When I ask my questions, I'm asking them of the auditor general, Nordic Scotland, if it's a different answer for either. Please let me know. Are you professionally regulated? Yes. We voluntarily apply the international standards on auditing and the audit work that's carried out, whether for the audits that I sign off or for the audits that Audits Scotland staff sign off in their own names, are subject to all of the requirements of ISQC1 and the broader requirements that are there. We're not subject in a formal sense to review by either the FRC or the recognised supervisory bodies, but as of the last audit year, we have voluntarily appointed one of the RSBs to oversee the audit work, to provide me as auditor general, the Accounts Commission and the Board of Audits Scotland with assurance about the quality of the audit work. I would interpret that as you're self-regulating. We're not self-regulating in that we have now appointed an arms length RSB to work independently, to carry out the same reviews that they do of other firms and to report that in the same ways.  Yes. So, if somebody was dissatisfied with your work and if it was a commercial audit firm could go to the regulator, can they go to somebody to ask them to investigate you? They would come to me and to the board and we would provide you with the evidence that we have about the quality of the audit work as it happens in the first round of the audit work that was carried out of the audit review that was carried out by the RSB NHS Tayside when it was one of the audits and has come out as a 2A grading, which means that only limited improvements are required and it meets all of the relevant professional standards. I would still interpret that as being self-regulate and you're not statutorily regulated. In a formal sense, yes, but we've done everything we can to make sure that we're meeting the same standards because I have a very strong professional commitment as you would expect the quality of the work that we do. I understand that, thank you. On the question of the audit of the endowment fund, you distanced yourself from that, but you also said that they are included in the consolidated financial statements. To me, that means that you have an audit responsibility over those funds, regardless of who did the audit. Can you just clarify that you take responsibility for those audits? I think it's not quite accurate to say that I distanced myself from it. As a matter of fact, I don't audit or appoint the auditors to the endowment funds under the charities regulations, they appoint their own auditors. It's also the case, as I said, that since 2013 the endowment funds have been consolidated within the board accounts and the auditors follow the requirements of ISA 200 in doing that. You may not have the right to get certain information. No, I said that we don't have access to the same degree of access to a body or a fund that we don't audit as we do to the ones that we do. But you must judge that as not a limitation in your school because there's no comment in the financial statements. Absolutely. We apply ISA 200 and Fiona and Bruce will be very happy to talk you through how they do that in relation to the NHS Tayside Endowment Fund. Okay, thank you. I've asked questions before on the SPA audit and this where we have a clean financial statement opinion and then quite damning section 22 reports. In the chamber, this week the cabinet secretary referred to the financial statements having clean opinions. Is there some misunderstanding then between your stakeholders as to the meaning of your audit work on the financial statements? I'm not sure there is, although I think there is a misunderstanding in this case. My recollection of the official report is that the cabinet secretary said that this hadn't been raised by the external auditor. I think that's incorrect. It clearly was raised by the internal auditor in the annual audit report, which is in the public domain. That's an important difference between the public audit regime in Scotland and the audit regime in the private sector. The public sector auditors have reported in public since the establishment of Audit Scotland, and that report has been available both on the NHS Tayside website and on the Audit Scotland website since the conclusion of the audit. There's a very clear mention of this issue in the annual audit report for 2013-40. My recollection of the annual audit report to me is the one on the financial statements. I have here a copy of the report on NHS Tayside for 2013-14. I've talked about the current year. The same will be true for the current year, but in every case the auditor is required under the legislation to report to the members of the board and to me as auditor general, and that is available in the public domain. It contains a very clear reference within the executive summary to the retrospective transaction between the Endowment Fund and the NHS Board. The audit opinion is a short form opinion and certainly was in 2013-14 about true and fair view, and the transaction doesn't affect the true and fair view or regularity. The wider annual audit report, which is an important part of the public audit regime in Scotland and across the UK, contains a clear mention, and it's that which provides the basis for the further reporting that I can do under my personal statutory powers. Liam Kerr mentioned about who might know about this. My experience is that whenever there's a troublesome event, it's never just one person that knows about it. You asked about what other audit processes—to me it's professional skepticism and what you might call an auditor's nose—to know that it's something not right. Can you tell us that you had no feeling that something wasn't right in NHS Tayside? Audit Scotland weren't the appointed auditor in 2014. I think that it's already been discussed that we have reported extensively on our concerns about the financial sustainability and the financial position of the board. That was in our annual audit report that was then picked up in the section 22 report. As a result of the issues that have been identified recently in terms of the accounts, the eHealth transaction is clearly a misstatement in the accounts but not of material nature. I've explained already how we were not able to identify that because it was not identified in the Scottish allocation letters. The endowment fund issue is not an issue for the 1617 accounts. The consolidation into the group was accounted for appropriately. Thank you all very much indeed for your evidence this morning. I'm going to suspend for two minutes for a changeover of witnesses. Thank you. I'd like to welcome Caroline Gardner back to the table along with her colleagues from Audit Scotland for item 3, managing the implementation of the Scotland Acts. Mark Taylor, I'd like to welcome you, Assistant Director, Michael Oliphant, Senior Audit Manager and Morag Campsy Audit Manager. Auditor General, I believe that you have a statement. The report that I'm bringing to the committee today is the fourth in a series of reports examining how the Scottish Government is implementing the new powers arising from the 2012 and 2016 Scotland Acts. My report assesses the progress up to the end of January this year and provides an update since I last reported in March 2017. As the committee knows, the 2012 and 2016 Scotland Acts devolve a range of responsibilities for taxes, borrowing and social security. Implementing these powers is a huge and complex programme of work. About 40% of the Scottish Government's plan spending in 2018-19 is expected to come from Scottish taxation and borrowing and this will increase to about 50% by 2020. As a result, managing Scotland's public finances is fundamentally changing and the Scottish budget is becoming increasingly complex with greater uncertainty and volatility compared to when the budget was relatively fixed through the block grant from the UK Government. The way in which the Scottish economy performs relative to the UK economy will have a greater influence on the Scottish Government's choices over tax and spending than ever before. Implementing and managing the new powers alongside the Scottish Government's current responsibilities and responding to the UK's withdrawal from the European Union has significant staffing implications. The Government has been modelling its workforce arrangements and refining its processes for collecting workforce information over the past year to help inform its recruitment plans. This starts the process of workforce planning at all levels of the organisation, but there's lots still to do. It will be difficult for the Government to recruit the staff numbers and skills needed to deliver the powers in time. Im pleased to report that the Government's social security programme has made good early progress. However, a significant amount of work is required this year if planned timescales are to be met. This includes launching a new agency, Social Security Scotland, to deliver the carers allowance supplement in summer 2018 and putting the foundations for the required IT infrastructure in place to deliver the devolved benefits. This will require effective working with other organisations such as the Department for Work and Pensions. The programme isn't without risk and I highlight a number of these risks in my report, along with areas to prioritise. Ensuring enough time is built into plans for assurance activities, for procurement, recruitment and succession planning will be key to managing those risks. Finally, the cost of implementing the new powers will be significant. The Government estimates that the Social Security powers alone will cost around £308 million to implement. By 31 March this year, the Government had drawn down the full £200 million UK Government contribution towards the cost of the new powers with the access to be funded from the wider Scottish budget. There is a need for greater transparency and a better understanding of the overall costs of implementing the new powers to support financial planning. Having a clear picture of how much it is costing to implement the powers of the Scotland Acts and how that is being managed will help the Parliament's scrutiny and decision making in the years ahead. My report also highlights the need for the Scottish Government to finalise and embed the governance and organisational arrangements for the new Scottish Exchequer to oversee the continued implementation of the Scotland Act powers and the management of Scotland's public finances. As always, we will do our best to answer your questions. As ever, Auditor General, I am grateful for the report, which I think is very detailed and comes across as fair and balanced. I am highlighting the good things, but I am not afraid to highlight the risks. Indeed, some of the risks around the IT have been highlighted at page 32 in the IT system. Of course, the committee has looked extensively at IT systems over the past wee while. You highlight a number of risks on page 32 with the delivery of the social security IT platform, the third one down being the initial design. The Scottish Government has sent us a letter that I presume you have seen which challenges rather robustly one of the particular risks that I have highlighted. What they say is that those statements are factually inaccurate, and my officials discussed the detail of this with Audit Scotland on a number of occasions and requested that the inaccuracies be corrected. Unfortunately, they were not. I was struck by the robustness of that language, and I would like to hear your thoughts on that, please. You will not be surprised, I guess, to hear that I disagree with the description of this as a factual and accuracy. We take very seriously the need to agree the content of our reports with the people that we are reporting on, in this case the Scottish Government, specifically precisely to avoid this committee having to get into arbitrating between my reports and the people that we are reporting on, so that you have that professional evidence based on which to found your work. We engaged well with Scottish Government colleagues throughout the process. It is correct that that issue was raised in clearance, and we were very happy to add to the report what you will see as a second bullet point in the third column of that risk, which recognises that the new case management system is based on an existing multi-benefit system that delivers complex benefits in other countries, as the Minister for Social Security says. Nonetheless, I concluded in finalising the report that the risk set out on the left-hand side of that column still remains. The Government is managing the risks reasonably well at this stage, but I think that it is factually correct to say that the risk remains. For the avoidance of doubt, you disagree with that statement in the minister's letter? Yes, I do not think that it is factually inaccurate at all to say that that risk remains while reflecting the action in which the Government is taking to mitigate it. Willie Coffey It is really on the same area, Auditor General. What is the basis for saying what you have said, though? Has there been some kind of technical assessment carried out to enable you to come to that conclusion? As you know, we have reported on IT systems extensively over the last few years, and I think that we have built up our expertise and experience in doing it. I will ask more. I have been involved in a lot of that work to talk you through the evidence base for the conclusion that I have drawn there. As the Auditor General was saying, what we are trying to do in the years is to highlight some of the risks. As we have set out the way that the Scottish Government has chosen to create this platform is to do it on a component basis. That has shown in that we have tried to summarise that in Exhibit 8. With the case management system that they have procured to deliver the first wave of benefits, they have procured an existing multi-benefit system that does deliver benefits elsewhere. However, it will have to be developed to meet the needs of whatever the system that the Scottish Government chooses in terms of the types of benefits and the rules around that. We feel that it is still at a risk. It is still at an early stage. The particular contract was issued in November, so the first series of sprints was only taking place in January and February, just as we were finalising the report. At this early stage, we are highlighting that as something that needs to be kept an eye on. The fact that it is already used in other countries helps to some extent, but because it is at an early stage and it still needs further development, that is why we are highlighting it. Is your comment that the CMS that we are talking about being able to support the wave 1 benefits that you are saying from your technical assessment that you consider that it cannot support post wave 1 developments without procuring more another piece of software? I think that that is the issue that is at its date here, whereas the minister is saying quite clearly that it will do. As we have set out that the system does already in other countries deliver some complex benefits because the later benefits, the disability benefits, are quite complex. Until the bill passes and decisions are made around some of the rules and assessments around that, it will obviously then need to build the system around that. The initial contract is just for the wave 1, which are less complex benefits. In our view, there will still be quite a lot of work to do in any further contracts to develop that particular system further. Have you actually seen the software? We have not seen the software, as I have said. The first few sprints were just taking place in January and February, which is when we were finalising the contract. We had not undertaken any work on that particular area at the time. I should also say that the procurement process and the system, there are assurance frameworks in place that you will be aware of through the Scottish Government and technical assurance as well. The tender itself had gone through that technical assessment and was given the green to go to the next stage. Have you spoken to IBM, who are the contractor? What their view is, because it is clearly a requirement of them to deliver this in such a manner? Have you spoken to IBM? That did not form part of the audit. As I said, it is at an early stage. The contract was just awarded as we were going through that process, so we did not undertake that. That might be something that we consider doing as we continue to look at the area in the future. Mr Cofi, Mark Taylor wishes to add some evidence. Sorry, I never saw you and Mark. That, thank you, convener. I will add a little to that. Exhibit 9, the purpose of Exhibit 9, is probably helpful to clarify that a little bit. Exhibit 9 is not a list of things that have gone wrong. I would characterise that as a list of things that the Government needs to get right. As Morag says, the system is not being built yet. We are not in a position to undertake a technical assessment of it. From our perspective and from our experience of working in similar systems, this is something that the Government really needs to get right, so that, as the system is built, it has the ability to have the other components plugged into it. That is the risk that we are looking to flag at this stage. As the Auditor General said, our judgment is that it is a live risk. It is something that the Government is alert to, given the Cabinet Secretary's response and something that is managing. We flag it for the committee's purpose and the wider purpose of Parliament to be aware that that is one of the issues that needs to be managed through and worked through. I understand that, but to say that the CMS may only be able to process wave 1 benefits when the Government and perhaps the contractor, if we ask them, would say the exact opposite. That is a fundamental difference here in the report. I have never looked at a picked up matter in Audit Scotland's reports in the years that I have been at this committee that says something that is polar opposite of what the Government is saying. Perhaps the contractor is going to say to us about that. The other bit of evidence that I play in, Mr Coffey, comes from Exhibit 5, which breaks down for you in a bit more detail the wave 1 benefits and the post wave 1 benefits, as the Government describes them. It is very clear from that that, in terms of complexity, the number of people affected, the amounts of money involved, they are very different things. Wave 1 is very small compared to the post wave 1 benefits, and that plays into our judgment as well. I echo strongly what Mark has said. We are not saying that this is something that has gone wrong. We are saying that it is something that the Government needs to stay on top of. Given the real importance of a smooth delivery of these benefits to the people who rely on them, who are some of the most vulnerable in Scotland? Of course, but there is not a technical assessment that you have carried out when you have not spoken to IBM and you have not seen the software. How can you conclude that this is a possibility? When you are being told the opposite, it is not the case? Our judgment was that that is inherent in the way in which the system has been pieced together, that clearly where there is one component that is a small but important part and a platform on which everything else is built, that that component needs to be designed and built in a way that allows those other components to be plugged in. That is the point that we are making, and from our perspective that is a significant thing that the Government needs to get right going forward. From memory, I remember that almost half, from more than half the cost of the transitions for social security system is down to the IT. Systems, how are we in terms of monitoring that cost estimate for the delivery of the programme? I do not see a general overview about that overall cost estimate. How? Exhibit 7 in page 26 sets out the breakdown of the figure in the financial memorandum to the bill of IT costs of £190 million. The contract that we are talking about is in the order of £8 million of that full package. That gives you a sense of how, although it is a core part, how much extra has to be built on to that. We make some comments in the report about the nature of the cost thing of the IT system and the stage that it is at. There is a lot still to be built. There is a lot still to be decided. As those decisions are made, we would expect, when we say that in the report, greater clarity and precision over the amount of IT costs. That will be alert to and continue to monitor as we go forward. Is it on track at the moment as far as we can tell? Morag may want to ask that, but we have made comments elsewhere in the document about the visibility over the overall cost of much of the work and the refinement of that. I think that the money that is being committed at the moment is within the budgets that are available. I guess that one of the biggest concerns about this is really people staffing it, because there is something like 1,500 staff needed. I understand according to your report here that a fair number of them have come from other parts of the Scottish Government. In paragraph 19, you make comment that this has placed pressure on other directorates' ability to deliver businesses' usual activities. You quote other new powers and the plan for the impact of the UK's withdrawal from the EU. Can you quantify that in any way? Is that just an assumption or is it based on something that you have seen? I will ask Michael to come in at a moment, but first of all, there is a straightforward sense coming from our engagement with Government as their auditors that people are under pressure. There is business as usual, which is demanding in itself. There is the new financial powers coming through and the preparations for the UK's withdrawal from the European Union, whatever that may mean for Scotland, and clearly that is a very live question at the moment. We are conscious from our engagement that people are under pressure, and we also know that people being transferred from other parts of the organisation into the social security team is having an impact on those pressures elsewhere. Michael, do you want to put a bit more flesh on the bones of that? As we point out in the report that the Scottish Government has taken some important steps in identifying its workforce requirements, particularly over the last year, what we would like to see is for them to extend that over five years, and they have started plans to do so. A lot of that comes down to the movement from generalist skills to more specialist skills, particularly in things such as long-term financial planning, financial modelling, economic forecasting. As we have already touched on IT and digital skills, an element of that is around the need for cyber security specialists. A lot of that is current needs, but what we are keen for the Scottish Government to do is to map out the longer-term needs. In fact, there are unknown things at the moment, as best as they can. You mentioned that the UK has planned withdrawal from the European Union, and it has been one of them. We have talked about IT skills shortages quite a number of times in the past on this committee, and again, Willie Coffey raised that today. You are talking about a wider spread of skill shortages. Is there a shortage in the market of skills other than the IT skills, which we are already well aware of? Are there other shortages in the market? I think that it is fair to say that there is, and I think that that is part of the challenge that is facing the Scottish Government, is that it is not just dealing with looking to get numbers in. It is the availability of the required skills in the market. It is trying to compete externally as well. That is also a risk that the Scottish Government needs to manage in relation to retaining the staff that it does have and that it does not lose them to external providers, whether it is in relation to IT or finance. That is why we have undertaken some work to develop its talent management programme, with a view to trying to retain the key skills that it has got, as well as looking for additional support. I suppose that it would be far too simplistic to say that, if a body of work is taken from one area of the civil service to another, that some of the skills would follow with it, because there would be less work in the remaining part of that body, if that makes sense. Are you referring to skills within DWP? Yes. In principle, that is probably right in practice that the scale of DWP's activity, which is transferring, is very small relative to their overall work, whereas it is very significant compared to a Scottish Government that has not had to do this before. It is unlikely that there will be surplus people in DWP on any significant scale to help fill the gap. I know that it is one of the things that the team has been looking at. Michael, do you want to add to that? Not much more to add to that. One of the key things is the transfer of knowledge where a member of staff does leave a directorate to move into another one. One of the key things that we have flagged to the Scottish Government in our discussions on in this specific topic, and one that they are keen for them to include within this longer-term workforce planning, is where people do move from one part of the Government to the other. They ensure that there is a transfer of knowledge that takes place. That is particularly important where they are using short-term contractors or people who come in in their employment. Although that might provide a short-term fix in terms of the skills, it is important that it is part of their work in the Government that they are able to pass on that knowledge and expertise to others. Are you satisfied that there are fairly robust processes in place for that to happen? I think that it is improving in terms of the work that we have done, the analysis that we have done over 2017. More needs to be done in relation to that to identify the numbers of people that are required, the types of roles that are required and certainly the skills that are required over the longer term. I am pleased to hear that the Scottish Government has put in place a good workforce plan. That is certainly the first step, but do they have a robust recruitment process? I realise that you are limited by what is available in the market, but is it constructed in such a way that it is going to get the best out of the market? I think that it is possibly too early for us to say, because a lot of the substantial recruitment in terms of the numbers that you mentioned, the 1,500 for the social security agency, that is still to take place. Certainly that is one of the biggest challenges facing the Scottish Government, particularly in relation to social security. It is not just the skills, but the numbers that they need in place, particularly with the external competition that they are facing as well. Clearly all the 1,500 are not going to be highly skilled IT experts or financial experts. A lot of them will be counter staff and so on, who are dealing with the people. Do you think that there is more that the Scottish Government could do in that regard, or are they doing all that they can, given the limitations of the market? I think that, as we have said in the report, they have made some important early steps in relation to that in terms of identifying the immediate need. They have taken some steps to integrate their workforce requirements in terms of the recruitment processes, but previously that used to be done in isolation. Each director would identify their own recruitment needs and take forward recruitment campaigns on their own, but there is a better process that is now in place to co-ordinate and integrate the workforce planning requirements and, therefore, the recruitment strategies that will come out of that. I think that it is too early to say whether that will be effective on that. Liam Kerr Thank you, convener. I want to—you mentioned at the outset about the 200 million, the budget and the draw-down. To put this in context, the key message for, under the fiscal framework, the UK Government will contribute 200 million to the costs of implementing the new powers. The Scottish Government will have drawn down all of that by 31 March 2018, so we will assume that it has done. The Scottish Government has not estimated the total overall cost of implementation. That, just as a statement, concerns me. In March 2017, I think that you raised exactly the same point, or I think that I am right in saying that you will correct me if I am wrong, that you raised exactly that in your report and said that the Scottish Government really ought to be working out how much money it is going to need to do this. Is it true that nothing has apparently been done in that regard? If so, doesn't that concern you? I think that the first thing to say is that the 200 million is the sum that was agreed within the fiscal framework as being the UK Government's contribution to Scotland's implementation costs. It was never intended to be an estimate of the costs of doing it. It was negotiated and agreed between the two Governments. Beyond that, for that very reason, I think that it is important that the Government does both develop its own estimates and make those more transparently available to parliaments and others with an interest to support parliaments decision-making around things such as the social security bill, proposals around the new tax powers and so on. I do not think that it is fair to say that nothing has been done, but I think that it is becoming increasingly urgent that that completeness and transparency are taken forward. I will ask Mark to tell you a bit more about what we have seen over the last year. I think that to pick up on the premise of the question, Mr Kerr, we made the recommendation last year. We emphasise in this report that that has yet to be done and we think that it is really important that it is done so that there is a sense to Parliament and to the public at large how much the package of new powers is going to cost. There is some information around that. There is the estimate of the £308 million around social security that we talked about, and we were able to pull together some figures for the report that you will see in Exhibit 3 from Exhibit 4 from various sources, and those sources were available in the public domain. However, the essential point is that there is no overall assessment done by the Government and to illustrate the point, we had to work quite hard to pull together the numbers on Exhibit 4 from lots of different places. Our point is that there needs to be a greater clarity about what is the total expected cost. Yes, that cost needs to be refined as decisions are made and things go on, but we think that it is important that Parliament is clear what figure the Government is working to. You then go on in the report to say that the excess—this is the bit over the £200 million contribution, and there will be a bit. You mentioned the £308 million of social security, for example. Any excess will need to be funded from the wider Scottish budget. Can you put that in context for me? That is presumably cash that otherwise could or perhaps should be spent on other spending commitments by the Scottish Government. Is that correct? It is just going to have to be pulled from somewhere and spent somewhere. As the Auditor General explained, the £200 million is a contribution from the UK Government that has been agreed through a political process. I think that the expectation was always that the package of powers will cost more than that. Therefore, by definition, the remainder of the balance needs to be funded from amongst the Scottish budget, and that is the choice that the Scottish Government and Parliament make about how it allocates its budget in order to achieve those aims and how much it allocates to do that. It was always expected that that was the case. Our point is that there needs to be greater clarity on the extent to which that is likely to be the case, and we also make some specific points about how that is treated in the budget so that there is greater clarity for Parliament about the money that has been allocated on the timetable for that. The lack of clarity in planning really does give me calls for concern. I want to take you back to you mentioned, Mark Taylor, the £30 million on social security. At paragraph 30, you said, at the time of publishing its 2017-18 draft budget, the Scottish Government had not prepared detailed spending estimates for the social security programme. Where is the £30 million coming from? Is that a finger in the air thing? How accurate is the £308 million? The £308 million is the initial assessment from the financial memorandum that goes with the social security bill. The Government has given evidence elsewhere on the make-up of that, and inevitably that includes a fair number of estimates and assumptions about some decisions that have yet to be made and what the financial consequences of those decisions are. It is the Government's current estimate. Within our report, we describe how the Government needs to continue to refine that estimate and that figure as it takes decisions in the future. One of the big parts of that that we touched on earlier is the IT element of the cost and the extent to which there is a fair amount built into that estimate for uncertainties. Optimism bias is the technical phrase, a fair amount built into that, and we are clearing the need for the Government to, as it makes decisions, to be able to bring that figure down and provide more certainty over the expected level of costs in that area. If we start from position, it says that you recommended similar things in March 2017 as to what is being recommended now. Do you get any sense that this next year will be different and we will produce a different report? We are always optimistic, and the basis for that optimism this time out is in discussion with the Government. We understand that in the report that will prepare over the next month, which is the section 33 report on progress, it intends to give more indication of the overall cost in that report, and we would welcome that if that was to happen. I am grateful. I want to ask about the new borrowing and reserves powers. A paragraph 130 in the report of the General Auditor General is a paragraph that I confess that I do not entirely understand and I wonder if you could clarify it. It says that the Scottish Government has not agreed the overall principles and policies for borrowing and use of reserves, but those powers are now available. It is not clear to me from the subsequent paragraphs whether that means that they are not able to use those powers yet or whether they are using them under some kind of temporary agreement with Treasury. Can I refer you to Exhibit 1, which sets out the timeline for the new financial powers? That is on page 8 of the report. You will see in the 2017 block the increased borrowing reserve powers setting out both the overall limit and the annual limit. Those powers are now in effect and the Government has access to the overall limit subject to the annual limits for both borrowing and moving money in and out of the reserves. The point that I was trying to make and clearly not doing very clearly in paragraph 130 is that it would be a real contribution to financial transparency and to Parliament's decision making if Government were to publish the principles that it plans to apply in using the borrowing powers. To what extent does it intend to draw them down to invest in capital infrastructure? To what extent does it intend to hold back some allowance in either the borrowing powers or the reserves to allow for the unexpected that may come out over the foreseeable medium-term future and just the policy decisions that it needs to make about the way that those things will be used rather than providing Parliament with proposals for decision in isolation each time? I think that the next paragraph 131 refers to a memorandum of understanding that is expected at the end of March, which has now passed. I just wonder if that did materialise. I'm afraid we have no immediate information on that, but it's certainly something that we can get back to the committee on. If I could just go back to the software for a moment to please the auditor general in paragraph 76, the RU alerted us to the potential risk in our dependency on the DWP to modify their systems so that we can make them fully compatible with others. Is there any agreement that you know of in place in the project for the DWP to agree to modify on time or whatever? It seems to me that that particular aspect is one where we have no control whatsoever in the ultimate delivery of this system unless it's by agreement written into the contract perhaps. Could you tell us a wee bit more about that? We conclude in the report and it's part of the key messages on page 10 that the Scottish Government has effective working relationships at official level with the UK bodies involved, and that's primarily DWP and HMRC. I'll ask Mark I think to talk a little bit more about what we see in detail around that. Thank you, auditor general. The complexity of this programme means that there are a whole range of discussions around our whole range of systems and interfaces across the range of activities that are set out in Exhibit 5, and those are at different stages. We say in the report and we have evidence that at official level the DWP and the Scottish Government are working well together on those, and we also set out in the report some of the governance arrangements, both at official level and ministerial level, through which those discussions take place. As a result of that, there is a degree of shared project planning and there's a degree of project planning, which is Scottish Government project planning. The risk there is to make sure that those two things are co-ordinated and work together. We also, in the paragraph that you've picked up, are quite clear that this is a fundamental part of making sure that things progress on time. It's important, I think, for the Scottish Government to manage its relationship with the DWP and it's important that both parties continue to work well together if the whole package of change is going to be delivered on the timetable that's set out. If everyone's working well together, why do you say there is a risk that the Scottish Government requirements are not given enough attention due to the DWP's other priorities? Why would you say that if everybody's working well together and getting on fine, has there been a contractual agreement in place to deliver this for us or is it a getting on fine arrangement? The projects are at an early stage. What we can point to is the things that have been delivered and the individual agreements between the DWP and Scottish Government in relation to things like Scottish universal credit choices, for example, and agreements are being put in place around some of those areas, other areas around the wave one benefits and their particular arrangements and agreements that have been put in place there. The reason for flagging this up is, again, at an early stage on this project to be clear from our perspective. This is an absolutely fundamental thing that the Government needs to get right and that both parties have a part to play in that. We have no direct visibility, of course, over the operations of the DWP and we've talked a previous session about audit arrangements and some of the limitations in those. Where we sit at the moment, there are no immediate signs of concern, but this is an inherent risk in the way in which this project needs to go forward that absolutely Scottish Government and absolutely DWP need to pay attention to. To be clear, there is no contractual obligation in the part of the DWP to deliver what is required on time for this project. I think that it's worth being clear that in contrast to the arrangements for the devolution of income tax, where the Scottish Government is required to collect and administer that through HMRC, the Scottish Government has chosen to deliver its social security powers with the Department for Work and Pensions, so that changes slightly the dynamics, the set of things that need to happen. As Mark said, the evidence we have suggested so far that's working well and there is a long way still to come and it will depend on good joint working from both parties here in Scotland and in the DWP itself. General, half of the 1,500 jobs have been promised by the Scottish Government to Dundee and the first wave of benefits have to be administered and given next summer, but we're in a situation where the Scottish Government still hasn't identified premises for the new agency in our city. I understand that the minister might be making an announcement on that next week, but are you concerned that this is indicative of where the Scottish Government is in its planning process, that to this date they still haven't identified premises from which this operation is going to work? I think that probably the overall message of the report in relation to social security is that the early progress that's been made is good, but that 2018 is absolutely critical in terms of establishing the social security agency and being able to deliver that first wave of benefits next summer. We've talked about the range of things that need to happen for that to be achieved successfully. It is premises, it is staffing, it is the IT system, and although the early progress is good, there's a huge amount to be done over the remainder of this calendar year to make that happen in practice. Do you have expected something as fundamental as where they're going to operate from to have been identified by now? I think the question is less whether that particular announcement or decision should have been made by this stage, but the overall ambition of looking to deliver the first wave of benefits by the summer of 2019, we think it's achievable, but as we say in the report, we think it will be challenging to get all of those things in place. With that timescale, naturally decisions are going to be announced in relatively short order, but there's no room for delay and no room for slippage in doing that. It's my understanding that nearly 600 people applied for the first 80 jobs that were advertised, so there's certainly a lot of interest in the community for those jobs. I'd like to thank you all for your evidence this morning. I now close the public session of the Audit Committee and move into private session.