09:31
Agenda item 2 is consideration of the Auditor General for Scotland’s section 22 report into the 2024-25 audit of Historic Environment Scotland.
I welcome our witnesses. Stephen Boyle is the Auditor General for Scotland and Lisa Duthie and Carole Grant are both audit directors at Audit Scotland.
Before members get into their lines of questioning, I invite the Auditor General to make a short opening statement on his report.
Good morning. I am presenting this report on the 2024-25 audit of Historic Environment Scotland under section 22 of the Public Finance and Accountability (Scotland) Act 2000.
The report brings to the committee’s attention what we regard as unacceptable governance at Historic Environment Scotland, including weaknesses in procurement, personal data breaches and unclear processes for the distribution and use of complimentary tickets to events at its venues.
Historic Environment Scotland has more than 400 electronic purchasing cards, which incurred £1.9 million of expenditure in 2024-25. Despite that, the policy has not been updated since 2019 and audit testing identified a lack of compliance with the policy, including cases where expenditure above the £1,000 threshold was incurred without the required three quotes to provide assurance for value for money. The auditor also reported that almost half of the foreign travel cases that were reviewed had either not been appropriately authorised or that the expenditure incurred had exceeded the originally authorised amount.
We also report on the archive house project. We again take the view that it is not acceptable that the project continues to incur expenditure despite being cancelled in 2024 and that the decision to end that key project was not supported by appropriate governance or scrutiny.
I note that Historic Environment Scotland is currently navigating a period of significant instability and challenge. During 2025, it operated without a chief executive or an accountable officer for almost six months of the year. Although I recognise the complexity of the situation, I believe that the Scottish Government should have appointed a substitute accountable officer to provide the necessary leadership and accountability. I further note that a new chair was appointed in September, and an interim chief operating officer has also recently been appointed.
It is clear that it is critical that strong controls are put in place to prevent the risk of fraud and to demonstrate that value for money for the organisation is being achieved. The external auditor will, of course, monitor developments, including the implementation of the audit recommendations. As ever, I will take a view regarding any necessary further public reporting following the conclusion of that work.
As we usually do, Carole Grant, Lisa Duthie and I will do our utmost to answer the committee’s questions.
Many thanks, Auditor General. We have a wide range of questions, so we will get straight into them.
I will kick off—perhaps I am abusing my new position of power. I am quite intrigued by your opening comments. You used a number of phrases and a lot of terminology that, unfortunately, the committee has heard before in section 22 reports, on governance instability and unacceptable levels of governance in a public body. Based on your understanding, what is the root cause of this period of instability at Historic Environment Scotland? How did it get itself into such a situation at the time of your audit?
I will shortly turn to Lisa Duthie, as I suspect I will several times today. I drew my conclusions in the section 22 report from her work because she is the appointed external auditor. She can give her own view, but it might help the committee if I refer to the report’s appendix, which sets out the timeline of some of the changes on the board and in the senior leadership of the organisation. It also references some of the instability and the volume of turnover.
I cannot escape that there was an absence of a chief executive or accountable officer for a prolonged period in 2025. Towards the end of the year, the organisation reported that the chief executive had returned from a period of leave to resume responsibility for the accountable officer elements of the annual report and the accounts. The role of the senior leader is broader than the annual report and accounts; it encompasses leadership and personal responsibility for value for money across many of the organisation’s transactions. That there was an absence of leadership in the organisation is such an important factor.
In the report, we also refer to concerns about the organisation’s culture. The public response to the section 22 report by the chair of Historic Environment Scotland, which I welcomed, included the important contribution that the organisation will initiate a review of its culture and effectiveness, and we understand that the intention is to report on that in May. The committee will be sighted on much of the public commentary, media reporting and contributions from staff members of the organisation regarding concerns about some practices in the organisation’s governance and leadership. It is essential that all those concerns are fully investigated and reviewed, so that the organisation can understand what it is dealing with and, as all public bodies must, deliver what is needed to ensure value for money and the effective use of public funds.
There are a range of strands to consider, but it is important for the committee to hear directly from Lisa Duthie about her audit work, so I will bring her in at this point.
As the Auditor General said, throughout 2024-25, we saw a significant amount of change and instability in the organisation, which included interim appointments at director of finance level and chief executive level and, following that, the appointment of a permanent chief executive. In part, that might have contributed to what we see and what we have reported today.
It is important to point out that some of the risks that we have followed up through the audit process emerged at the beginning of the year and might have been noted in the previous audit appointment. That includes the risk that is associated with the volume of electronic purchasing cards held by Historic Environment Scotland, which was brought to my attention as part of the audit planning process. In my annual audit report, I also comment on board effectiveness and the absence of a self-assessment in the year that we audited. One of my report’s recommendations is that a self-assessment is carried out in the next year.
At the time of auditing, the archive house project was a known risk to the organisation and that is reflected in the internal audit’s limited assurance opinion, which noted that the “implementation of management actions” was disappointing, which is, in part, a reference to a review of that project that took place.
Thank you very much for that further update. Members have questions on many of the areas that you have identified in your report, so we will come back to you on them.
Auditor General, to go back to your summation of how HES got itself into this mess in the first place, do you understand it to be twofold in nature? There are internal problems with staff turnover and leadership at the very top of the organisation but, in parallel, there is a lack of oversight from the Scottish Government, given that HES is a public body. To put that in context, Historic Environment Scotland, which employs more than 1,600 members of permanent staff and has a turnover of £140 million in just one year, is also in receipt of significant amounts of public money by way of grant funding—around £70 million in the year that the auditors identified.
The importance of the role of the body and what it does on a day-to-day basis has surely been somewhat compromised by the instability and lack of leadership. Perhaps that has led to some issues of trust in the body from the public and those it assists on a day-to-day basis.
There are a number of strands to your points. No organisation will embrace, or want to be subject to, a section 22 report. I absolutely recognise that. We think very carefully about the publication of such a report, but we felt that there were matters of public interest and significance here that warranted reporting to the Parliament on the conclusions that the auditor reached in 2024-25.
I might turn to Carole Grant in a moment to address the sponsorship point that you make regarding the role that the Scottish Government has played. It is a welcome development that the chair of the board has identified the need for some consideration of the body’s culture and effectiveness. It will be really important to have that full, proper exercise, exploring some of the issues that have been identified and that remain unresolved, such as staffing concerns and the position of the executive team, together with issues around policy and the use of public funds.
In terms of Historic Environment Scotland’s financial structure—Lisa Duthie can correct me on this—the ratio of income is roughly one half public funding, while, for the other half, it is a very significant revenue-generating organisation. That is perhaps not surprising, given the nature of its facilities, how attractive they are and their use for events and conferences.
Importantly, it is clear that the body’s framework document, which was agreed towards the end of 2024, places a significant emphasis on its role in generating other income. There is a clear mandate, almost, for Historic Environment Scotland to bring in additional revenue by quite rightly exploiting its attractive resources. Those may be additional factors as to how the organisation got into the circumstances that it finds itself in.
There are internal factors concerning instability, including leadership and governance, but there is also the role that the Scottish Government played. As I have already mentioned, I do not think that it was the right decision not to bring in an interim accountable officer, given the vital role that is set out in the Scottish public finance manual for an accountable officer.
I will turn to Carole Grant, if that is helpful, so that she can say a wee bit more about how that all works and about how events unfolded from the Government’s side.
In your comments, Carole, it would be helpful if you could tell us what conversations you had with the Scottish Government, including any directorate or sponsorship team members, in advance of the production of the section 22 report, so that we get a feel for what the Government’s response was to the questions that you put to it.
Picking up on what the Auditor General has said and on the further questions from the committee, I had direct engagement with the sponsor team involved with Historic Environment Scotland: I had two separate meetings to explore what was happening. My understanding from those conversations was that there was regular engagement. As you will know, sponsorship entails an on-going relationship and engagement. Within the Scottish Government there are quarterly reviews, which involve taking a step back and assessing the relationship.
We talked a little bit about the sponsorship approach at the previous committee meeting that I attended, just before Christmas. Regarding the timeline for Historic Environment Scotland, I can confirm that, in the May assessment, it was moved from a green rating to an amber rating. The assessment of a sponsorship arrangement and how a body is operating uses the red, amber or green—RAG—status system. For HES, that rating moved to red later in the summer, in August, because of the issues that were emerging.
From an audit perspective, I had specific meetings with the sponsor team. I also had regular engagement through the director general assurance process, attending and engaging with meetings as well as providing evidence and having discussions about some of the issues that were raised.
To answer your question, I spoke to the specific directors and the directors general who were involved with the sponsorship.
09:45
Who was the lead Scottish Government sponsor who would be directly responsible for deciding to move the rating from red to amber to green? Who, in your understanding, provided oversight of the body’s sponsorship arrangements?
I might get the job title wrong, but my understanding is that it was Kenneth Hogg, the director of culture and external affairs, who provided the oversight of the sponsorship arrangements. He works across the culture space for the Scottish Government.
The assessment for the quarterly reviews of sponsorship arrangements is initiated by the central public body sponsorship unit and goes out to the sponsorship teams for completion. Then the process is that the assessments come back in and are considered in the round and that is what should be fed up through the DG assurance process to get a sense of the landscape and the risks that sit within it. That enables the director general to ask further questions and review where there are opportunities for wider learning or support that could be provided where particular issues are identified.
You may not know the answer, but is Audit Scotland aware of any other public bodies that are currently in amber or red on the RAG status list, in terms of their sponsorship?
There are other bodies that have amber or red ratings. The RAG status considers elements of culture, governance and finance. Fairly regularly, when we look at the assessments, we see that the financial position drives some of the considerations for the assessment. We have suggested that there should be more of a focus beyond the financial position. That should absolutely be considered where there are known financial pressures and a need to deliver efficiencies and savings, but there is an opportunity, as part of the assessment, to have more of a focus on governance and culture, and on staff survey results. All those elements form part of the questions that are asked.
In your professional opinion, was the move from green to amber to red a result of a lack of action or response to issues that the sponsorship team flagged? Or was it perhaps a result of issues within the sponsorship division in relation to the way in which it oversees or governs the body? Or perhaps the blame lies in both lobbies.
It would be difficult for me to give a clear assessment of that. It may be something that would be better explored with the Scottish Government. I will say that one of our proposals is that there should be more focus on positive assurance statements as part of the assessment. At the moment, many questions are asked and answered in the assessment but the actual impact is not always identified and fed through. Something about the statement, “I am reassured that there are no issues within this body,” might increase the emphasis and the focus for people when completing the assessment.
That is helpful. Auditor General, I have a final question before I pass on to my colleagues. The issue regarding the accountable officer seems to be the key one. We want to get our heads around why there was no accountable officer, even one who was appointed or internally chosen on an interim or substitute basis. Who was the actual principal accountable officer at the time of the external audit that your report is based on? Was any explanation given to Audit Scotland, either by HES or the Scottish Government, as to why there was no accountable officer for six months? What was the formal explanation?
As I hope that we set out in the section 22 report, there was a fluid set of circumstances. The first absence of the chief executive in May 2025 is referred to in the appendix to the section 22 report, which also notes the interim arrangements in the executive leadership team. The arrangement that the executive leadership team agreed with the former chair of the board was that a duty director would provide leadership in the organisation.
I will bring in Lisa Duthie if there is anything that she wants to add to this. When somebody goes off sick, we understand that you are never necessarily sure how long they will be off, and we recognise that, for the early period, the executive leadership team might have felt able to deal with the circumstances. However, there is guidance in the Scottish public finance manual that, if an absence of the accountable officer is going to go on for a period longer than a month or so—I think that that is right, but I can happily clarify it—that brings into play the likely or appropriate prospect of a substitute or interim accountable officer. As I mentioned in my opening remarks, there was a period of almost six months without such an arrangement.
When the accountable officer returned to work towards the end of 2025, it was in a limited capacity, only to finalise the annual report and accounts of Historic Environment Scotland. I would not diminish that; it is an important part of the accountable officer’s responsibilities. There are dedicated pages in the accounts in which the accountable officer asserts that they have done their job properly and that they are content with the transactions. However, that is clearly not all of their responsibilities, which include the day-to-day running of the organisation, both as the chief executive and in performing the prescribed key duties that are set out in the SPFM for the accountable officer.
It is the responsibility of the permanent secretary, as the principal accountable officer of the Scottish Administration, to appoint the accountable officers of public bodies, guided by advice from the sponsorship team and contributions from the governance of public bodies. We have seen a lack of clarity in why the Scottish Government chose not to appoint an accountable officer, notwithstanding the fact that there was uncertainty—it was a fluid environment—about how long the postholder would be absent. It is my view that a clearer intervention ought to have happened at a far earlier date. Further, the current circumstances are that, although the accountable officer is back at work, they are not yet fully exercising all the responsibilities of the chief executive or accountable officer.
Those are questions that we might rightly wish to ask of the Scottish Government in response to your comments. I will bring in a colleague in a second. Has Audit Scotland had any conversations with the chair or any members of the board of the agency? Presumably, the role of the board is to provide oversight of the governance arrangements, but it sounds as though there was a distinct lack of that.
I will bring in Lisa, who, as you would expect from her role as appointed auditor, has regular engagement with both the executive and the non-executive. She can set out some of the detail.
As we say in paragraph 8 of our report, we are aware that Historic Environment Scotland had on-going discussions with the Scottish Government and that various options were explored at the time. I point you to a particular email that I received from the former chair of the board following a request for an update on the position of the accountable officer. It clarifies that options were considered from the four-week period when Historic Environment Scotland became aware that the accountable officer would not be returning to work.
We know that, under normal circumstances, it is likely that a member of the executive leadership team would have stepped up into that role, but, given on-going matters, that was not a possibility at the time. Other options that were explored that we are aware of were the appointment of an existing board member, the appointment of an ex-board member and several appointment proposals that the Scottish Government put forward. We do not have a definitive answer for you on why an option was not agreed on at that time. It might have been partly due to the fact that the accountable officer intended to return to work, which we believe might have been a barrier.
Thank you for that further information. Mr Simpson has a supplementary question on this theme.
Auditor General, the section 22 report came out just last month and, at that point, there was not a permanent director of finance and corporate services. Do you know whether there is one now?
I will turn to Lisa for further detail on that position, Mr Simpson.
There is not. That post is still an interim appointment.
How long is the interim period?
We do not know the answer to that at the moment, although from recent conversations with the chief executive and the new chair of the board, I know that that is a priority for them.
I will pass over to Mr Beattie.
Auditor General, I would like to chew over procurement again. Paragraph 15 of your report states that
“there are weaknesses in the current risk, governance and control procedures that could affect the delivery of objectives”
and that there were weaknesses, particularly in procurement, relating to the inappropriate use of single-source justification. Internal audit raised that issue as part of your report. Did it raise it with the board, and if so, when?
It did. Lisa can talk the committee through some of the specifics of the work of internal audit. I think that she said earlier that internal audit also raised concerns about some of the procurement practices in the organisation. Importantly, its overall conclusion on the effectiveness of the internal control environment was one of a limited assurance.
That is significant, because it reflects that it considered the overall activity, and that would be strongly influenced by its judgments on the single source, which Lisa can say a bit more about. As we go on to say in the report, from supplementing the work of internal audit with our testing, we have concerns about the overall arrangements around the use of electronic procurement cards and the volume of members of staff in the organisation who used them—more than 400 of those cards were in place, as the deputy convener mentioned, against a staffing quota of around 1,700. There were concerns about how all those practices were operating. As I said when I discussed some of that with the committee at your earlier evidence session with the Scottish Government, those practices increased the risk around the effective use of public money and the risk of fraud that the organisation was dealing with.
I will bring in Lisa to say a bit more about the work of internal audit.
There are two separate points in paragraph 15. The first of those to touch on is the limited assurance opinion from internal audit. The reasons for that are set out in Historic Environment Scotland’s governance statement, as you would expect. The basis of that opinion relates to: the significant change in the leadership in Historic Environment Scotland, which we have also reported on; the implementation of management actions resulting from recommendations, which the internal audit service considered to be disappointing; and outstanding recommendations relating to the limited assurance opinion review of the archive house project.
The second point relates to an issue that was brought to my attention in July, and that was also shared with Historic Environment Scotland through whistleblowing. That was subsequently investigated by the internal audit department and the chair of the audit, risk and assurance committee in Historic Environment Scotland. From an audit perspective, I was looking for assurance that that had been carried out appropriately.
The conclusion, as set out in our report, is that there was an inappropriate use of single-source justification, to backfill a vacant post. Internal audit has subsequently indicated that a review of single-source justification will be carried out, and it has been identified as an area of risk in the organisation.
Can you comment on whether there is any correlation between the absence of the accountable officer and the introduction of those practices? Do they predate that absence, or is it something that grew over a period?
The particular point that we mention in our report predates the absence of the accountable officer.
I will add, Mr Beattie, that many of the issues that we are reporting on took place in the current financial year 2025-26 but straddle the 2024-25 financial year, which ended in March, into the audit reporting period, when the audit concluded at the end of December.
10:00
Lisa Duthie mentions in her report that the audit was delayed. It did not conclude in the expected timescale because of the absence of an accountable officer. In some ways, that delay allowed us to explore in more depth the circumstances that we set out in the annual audit report and the section 22 report. It is a combination of issues: some of the circumstances about the volume of procurement cards predate the absence of an accountable officer, but, to refer back to the appendix to the section 22 report, many of the events are relatively live or recent, having taken place in 2025 or at the tail end of 2024.
In relation to procurement, you have mentioned one or two of the weaknesses that were found. Were any others identified?
Lisa Duthie can give a bit of detail, but I refer you to some of the conclusions that were made in the annual audit report, based on the detailed audit testing that was undertaken on procurement cards and transactions. The testing identified
“instances where staff did not obtain and retain quotes for items over £1,000 in line with”
the purchasing card policy so that they could demonstrate value for money;
“lack of evidence to support the approval of staff purchasing items above the transaction limit of £1,200; lack of challenge by procurement for any requests to approve an increase”
in either a transaction or a card limit; and invoices not always including sufficient detail of purchases. Those are all matters of concern. In the report, Lisa Duthie goes on to give some specific examples, such as the purchase of accommodation and a replacement kitchen.
The organisation has to tackle some cultural matters when it comes to its use of procurement cards. It should rightly consider whether it needs to have as many of them as it does. A total of £1.9 million was spent using procurement cards in 2024-25, and compliance checks were carried out on approximately 8 per cent of transactions each month. Is that sufficient volume to give assurance to the organisation?
We are clear that there is a range of issues in respect of the organisation’s arrangements and its use of procurement cards. It should take a step back to take a clear view of whether they are appropriate and necessary in order to give it the appropriate range of robust internal controls on its use of public money.
Was that raised with the board? What did it do about it?
The commitment to review the organisation’s culture and effectiveness was an important part of the new chair of the board’s response. As part of that review, it would be appropriate for the board to step back and satisfy itself that its procurement arrangements for the use of public money are appropriate, robust and necessary for the organisation.
Lisa Duthie can say more about the direct interaction.
Regarding the board’s role, the risk of fraud was raised due to the volume of electronic purchasing cards and factors that are associated with them. That was discussed at the audit risk and assurance committee, and internal audit subsequently carried out a review of electronic purchasing cards. I reflect on that in my report’s recommendations.
More recently, we have seen a response from Historic Environment Scotland to wider procurement weaknesses. It plans to lower the procurement threshold for the involvement of the procurement team, it has planned procurement roadshows to take place over the next three months, it is planning training and it is strengthening the arrangements for conflicts of interest in the procurement process.
Just to be clear, the weaknesses that are mentioned in the annual audit report are those that prompted an internal audit review of procurement. Is that correct?
Yes, that is my understanding.
Do you have any information on when that review will be completed? Will you consider the outcome of it in your next audit?
Yes, absolutely—we will be considering the review. We understand that the chair’s review that has been mentioned will conclude in late spring of this year, and we will absolutely take a keen interest in the conclusions that it draws, together with the broader follow-up arrangements that we would undertake through the annual audit—as Lisa Duthie mentioned—regarding whether her recommendations have been implemented.
Of course, we will reflect on and consider any evidence that the committee chooses to take. What is important is that the annual audit is an audit of Historic Environment Scotland, but the section 22 report goes into wider issues, in particular some of the decisions that the Scottish Government took through sponsorship around the accountable officer. We will look across all those issues and think about any follow-up.
I will move on to look at data breaches. Paragraph 16 states:
“Historic Environment Scotland has reported eight personal data breaches between March and November 2025 to the Information Commissioner’s Office.”
That is quite a lot of breaches within a fairly tight period. Is there any connection regarding why they all took place?
It is a lot of breaches. Lisa Duthie mentions a couple of significant points in her annual audit report. One is the volume; it is unusual for an organisation to have that many data breaches in a particular year.
With regard to the circumstances—again, I will turn to Lisa, who can say a bit more about this—some of those breaches were investigated by Historic Environment Scotland and reported to the Information Commissioner’s Office. However, I think that it is quite significant that the Scottish Government was informed of the circumstances but was not satisfied with the conclusion that Historic Environment Scotland had reached on the matter.
As we note in the report—I am happy to turn to Lisa on whether we have any more up-to-date information—the investigations and the work of the Information Commissioner’s Office on the matter are still on-going, so I am not sure that we have much more information that we can share with the committee, beyond a recognition that that aspect feels like an important part of the context, and perhaps the cultural context, of the organisation during 2025.
I refer to Historic Environment Scotland’s governance statement. That document states that there is a requirement to disclose significant data breaches, and reveals that five of the incidents related to sensitive human resources matters being published in the press, including reference to senior leaders of the organisation. My understanding is that those matters remain open.
There was another incident relating to the transferring of sensitive data to another organisation without appropriate arrangements in place, and further incidents that related to the unauthorised sharing of personal data and to information being sent outwith the organisation to personal email addresses.
As the Auditor General has said, the nature and volume of those breaches reflects the internal challenges that the organisation is facing.
In my annual audit report, I also refer to a further data breach in addition to the other breaches. That related to board members sending emails to personal email addresses; it was reviewed by Historic Environment Scotland, which concluded that it was not of a significance that required it to be reported to the Information Commissioner’s Office. The Scottish Government was not satisfied with that response—however, I understand that the matter has now been reported to the ICO through a different route, and has been concluded.
Who in HES concluded that it did not require to be reported?
That was the information security manager—apologies; I may not have got that job title entirely correct—and the chair of the audit, risk and assurance committee.
Would that not have been reported to the board?
I am not sure if it was at the time.
It may be that Historic Environment Scotland has more detail on its internal discussions and engagement on the matter.
I would reiterate that something did not go right in this particular investigation. The Scottish Government sponsor team was not persuaded about how well the investigation had gone—albeit, as Lisa Duthie has mentioned, the Information Commissioner’s Office decided that there was to be no further action. It was subsequently reported that, even though Historic Environment Scotland initially decided that it was not necessary to report, there seems to be an appropriate case to review how well the organisation is handling data breaches. There are clear guidelines and arrangements for when a matter is or is not reported to the Information Commissioner’s Office.
Just so that I can be clear in my mind, there are two different investigations, then: one is the investigation on the question of board members; the other, presumably, is on other data breaches. What were those other data breaches? Are they the same, in fact?
Lisa Duthie may wish to add some detail on that.
So, there are five related to the board.
Are those cases still with the Information Commissioner?
Yes.
What sort of sanctions could be imposed as a result of that?
Do we have any idea about the timescale for finding out whether that will be an issue?
I guess we do not have any information on when we might hear about that from the Scottish Government.
It is a matter for the Scottish Government to confirm any on-going activity in that respect.
I want to follow up on some of that. There has been mention of stories appearing in the press. Sometimes stories can appear in the press because they have been deliberately leaked to the press. Was that the case here?
We do not know. I do not have insight into how the media reporting on the organisation came about. I do not think that any of us will be able to take a view on that until the Information Commissioner’s Office has concluded what the sources were and how the information came into the public domain. As Lisa Duthie mentioned, and as we set out in the section 22 report, the issue involves a lot of personal data and sensitive HR matters—that aspect has also been subject to public commentary. Some of that is subject to HR investigations that remain live in the organisation. The source and outcome remain to be seen.
10:15
I wonder whether there is a connection to the section in the section 22 report in which you refer to a “toxic workplace culture”. You did not give any details about that. This is your opportunity to explain what you meant by “toxic workplace culture”. What exactly was going on?
The report refers to
“allegations of a toxic workplace culture”.
Therefore, those are not my words—it is what the organisation’s members of staff referred to. They have wider concerns about engagement and the experience that they are having in the organisation. Some of the points about culture that I think are mentioned in both reports relate to the use of procurement cards and some of the practices in the organisation regarding expenses. We also include reference in both reports to the use of hospitality and tickets for events.
However, those are only indicators of cultural concerns. There are avenues for reporting any concern that is raised, whether that relates to HR matters, data breaches or wider concerns with culture and workplace practice. All such organisations will have whistleblowing policies, but the point is that issues are subject to proper investigation. That is part of the context of the report and some of the commentary around Historic Environment Scotland that was made during 2025.
As I mentioned when we briefly discussed the issue in December, the chair’s recognition of those concerns and his response feel significant. There is an opportunity to review the culture, and he is taking that opportunity during the early part of this year. It matters that staff are engaged throughout that process and that they have a full and clear opportunity to express their views. Like the committee, we await the conclusion of that review and will consider what it means for the next stage of our work.
Thank you. My next question is about the complimentary tickets, to which you devote some space in the report. You stated that Historic Environment Scotland gets
“complimentary tickets to events at its venues”.
Those are part of a contractual arrangement with the people who put on the events. If an event is put on at one of Historic Environment Scotland’s venues, it appears that the organisation will get a number of tickets. Do you know what the scale of that was and who was getting those tickets?
In the reporting on complimentary tickets, we were surprised about the lack of clarity regarding arrangements for their use—that is, how they are distributed, how that is recorded and who is using them. As you say, it relates to the context of the organisation’s work. It has many attractive venues in Edinburgh that will be used for significant public events, and complimentary tickets will be part of those contractual arrangements.
However, there is a lack of transparency regarding how many tickets are allocated, who they are being given to and how they are used. There needs to be a more robust set of arrangements for that. There also needs to be clear and satisfactory consideration of whether such arrangements are in line with policy and whether policies for the use of tickets are appropriate for a public body. I will bring in Lisa Duthie to talk about some of the specific details that we found during the audit.
In our report, we make reference to complimentary tickets that form part of a contractual agreement that is in place. Our sense is that there may be other tickets that are not part of that agreement. Our understanding from discussions with Historic Environment Scotland is that those tickets are allocated to support business development, to recognise and thank volunteers, and as a reward for and recognition of staff members. We have also been told that, depending on ticket availability, staff and external guests may be permitted to bring along a plus one.
We have reported on the absence of a policy to manage the distribution of those tickets and ensure that they are distributed appropriately—and, more importantly, transparently—so that there is clear justification for why individuals are given one of those tickets and what value that brings to Historic Environment Scotland as an organisation.
Do you know how many tickets have been dished out over, say, a year?
I do not have that exact figure to hand, but that is a question for Historic Environment Scotland.
It might be a question for you, though, if you did the audit and have raised it as an issue.
We have seen the evidence of the contract that is in place and the tickets associated with that contract, but we do not have a complete picture of all the tickets that may have been allocated.
So, we have no sense of the scale of that or the value of the tickets.
We do not have a complete sense of the scale, no.
We think that it is important, though. We can look at the number of events that will take place in Historic Environment Scotland’s facilities and the volume of people who will be going, but we do not have—and it would not typically be subject to an annual audit—the specifics of the capacity of an event and what happens to those tickets.
However, the context is the organisation, Mr Simpson. If Historic Environment Scotland has information on the number of tickets and how they were allocated, I am sure that it can tell the committee. What we are drawing attention to in the audit is that, first of all, there is no policy, which feels like a weakness in arrangements.
The following paragraph in the report says that although a register of interests is maintained for board members, there is no formal register of interest in place for the executive leadership team. I would not necessarily want to conflate those issues, but this is a public body that is operating as more and more public bodies are doing. I mentioned to this to the deputy convener a few minutes ago, but there is a clear mandate from the Scottish Government in its framework document to generate as much revenue as possible. When public bodies are operating in such an environment, they need to do so safely. Effective registers of interest and clear policies for the distribution and use of hospitality need to be in place.
I will press you on that. If somebody hires a venue, Historic Environment Scotland is entitled to a number of complimentary tickets. Do we know how many tickets it is contractually entitled to?
As we say, we do not have the precise number of tickets per contract. I do not know whether it is consistent from one contract to another, but I am quite sure that the organisation will have a clear line of sight on that.
I apologise—I do not wish to repeat myself—but it is very clear from our perspective that not having a policy in place for distribution brings risk to the organisation. There is a risk in relation to the perception of how it uses those tickets and which members of staff—or, as Lisa mentioned, family members or guests—are using them. When a public body gets into that style of environment, it needs to have stronger safeguards around any threat, or perceived threat, to their reputation.
I think that you would accept, though, that the scale matters.
I do.
If it is just two or three tickets per event, that is not a big deal, but if it is 50 or 100, it becomes more of a concern.
You could argue about whether the scale matters or not, but developing a policy ought not to be a significant matter. Just have a policy, given that it is a feature of the organisation’s business, on how complimentary tickets for the public body will be used, recorded and monitored so that it is all above board and does not invite suspicion or concern about the organisation.
I will move on to spending practices—and I note that reading the report reminded me of our sessions on the Water Industry Commission for Scotland.
In the report, you say that foreign travel has been undertaken without authorisation. I am struggling to think why any Historic Environment Scotland staff need to travel abroad, but, be that as it may, can you give any examples of when foreign travel has been undertaken without proper permission?
There were business cases for foreign travel, but our concern was around the approval of foreign travel and the amounts that were approved, which were not the amounts that were subsequently paid and not subject to the proper level of scrutiny. We recognise that circumstances can change, especially in a foreign country, but things have to be appropriately approved, and we see a gap in the arrangements.
Lisa Duthie can say a bit more about the nature of some of the foreign travel and our wider audit interest.
This is an area in which robust controls are really important, due to public perception and value-for-money considerations. We identified non-compliance with the business travel policy, which related to the authorisation of trips in particular. We identified instances of trips where a director and the chief executive were required to approve the business case for foreign travel, but that was not done.
As the Auditor General said, we expect there to be some difference between the estimate and the actual amount spent on such trips, but we also expect robust controls to be in place in that regard and that a review would be conducted following the trip as well. Examples of foreign travel that we reviewed included: teaching traditional skills in America; digital round tables, which were also in America; the study of mortar in Norway; and discussions, conferences and speaking events in the middle east, Zambia and Hong Kong.
The study of mortar in Norway—is that a joke?
No.
You are not joking. I cannot believe that. On the teaching of traditional skills in America, do we know what the traditional skills were?
The specifics and the value of the trips are probably questions for Historic Environment Scotland. We are drawing attention to the fact that, if the organisation deems a trip necessary—it is a matter for HES to have arrangements in place for this—it must have a business case, and as Lisa Duthie mentioned, that requires various levels of authorisation. Considering whether it is appropriate is up to the accountable officer, but that must then be followed through to ensure that the amounts approved are appropriate and that any variation is, again, subject to the appropriate level of approval. The detail of why a member of staff went abroad is absolutely a matter for the organisation.
Okay. I hope that we get a chance to quiz it on that.
Do you know the amount of money that has been spent on foreign travel?
At the time of our audit, we had not been provided with a complete list of the foreign travel costs, but Historic Environment Scotland has subsequently published—it is required to do so—on its website that £37,000 was spent on foreign travel in 2024-25.
Okay.
In closing, I want to ask you about something else. There was a leaving do, with the people who attended essentially shamed into paying back the booze bill that had been run up at taxpayers’ expense. Do you know who the leaving do was for and where it took place?
Lisa Duthie might know where the venue was, but the leaving do was to mark the departure of one of the board members. As we set out in paragraph 29, an event for some board members was held in November 2024. The invoice for the event totalled £875 for 11 attendees, which was based on food at £35 a head; the balance, for the purchase of alcohol, was around £500. As you say, Mr Simpson, that amount was repaid by board members.
We go on to say—
Sorry—it was only repaid after a review, though.
Correct. HES was reimbursed, with the organisation bearing the costs for food.
With regard to where it was held, Lisa Duthie may have that information.
10:30
The meal was held at a restaurant in Edinburgh that is part of the University of Edinburgh hospitality and events collection, on 20 November.
So it was at the university.
Yes—at Bonnar’s restaurant.
At Bonnar’s—okay. Right—that is good.
There have been other instances as well, according to your report, in which people have racked up booze bills on the public purse.
The policy is such that the organisation will provide wine at official hospitality events held either at a restaurant or a reception. However, the audit work, through both the internal audit and the external audit,
“identified bar recharges, including spirits, being charged without appropriate challenge.”
Again, in my view, it is part of the culture of the organisation—
Yes—that is it.
It comes down to whether the organisation has robust arrangements—it either does or does not have appropriate policies as a public body—and, more importantly, whether the policies are being complied with.
Again, that is why I think that it is so important that the review of the culture that the new chair has initiated follows through on those events and sets out appropriate parameters for this public body to follow.
You are absolutely right—it is a cultural issue. It is the same culture that we discovered at WICS; it appears to have existed in this case, too. Do you think that that has now stopped?
I do not think that I can give you that assurance yet. We can say that there are a number of important signs. There is an acceptance of the audit recommendations in the annual audit and the new chair has made important public contributions, but the organisation is still dealing with fluctuations and instability in its leadership. As ever, the tone from the top is important: there needs to be clarity around policies and their implementation.
We will absolutely follow up on progress on audit recommendations, and I will take a view, as I always do about the need for further public reporting on a public body.
Just for the record, I can reassure committee members that agenda item 5, which we will take in private, will be looking at next steps on how we may garner more information from either Historic Environment Scotland or the Scottish Government and the opportunities that are open to us to do so. We will discuss those later in the meeting, in particular around some of the areas that Mr Simpson has asked Audit Scotland about. Obviously, we will let you know if there is anything of interest, Auditor General.
I now invite Joe FitzPatrick to ask some questions.
Some of my questions have been touched on already, but I will go into them in a bit more depth. It feels like there are long-standing cultural issues that existed long before the audit and the specific issues with the accountable officer, but there is also a lack of transparency. I do not see how the organisation can move forward without improving its transparency, because that is what ultimately ensures that it gains trust.
First, you mentioned the lack of a register of interests for the executive leadership team. How unusual is it for a public body that there would not be such a register at that top level?
It is noteworthy; the fact that we refer to it in the report indicates that it is out of the norm. I will bring in Carole Grant, who can say something, from looking across the Scottish Government and other public bodies, about the extent to which that is commonplace or otherwise.
I think, however, that what is particularly relevant for this organisation is the fact that it is dealing with contractual arrangements and that it is generating £70 million in a commercial setting. Public officials should want to feel safeguarded in that environment and feel that they can be absolutely clear that they are transparent and—to go back to your point, Mr FitzPatrick—that there is no suggestion of risk to either individual or organisational reputation in what they do. It really matters that there is clarity not only among board members—it is welcome that their register of interests is in place—but that that extends to senior leaders and especially to those who are involved in procurement arrangements.
Carole Grant can offer a wider perspective.
Across the public sector, we have seen registered interests featuring more and being strengthened. As the Auditor General said, a register of interests is incredibly important where procurement contracts are being entered into. Particularly in relation to Historic Environment Scotland, given the nature of its hospitality, we would want openness and transparency around any potential risks long before people are entering into conversations or are in the room having those conversations. Given the nature of Historic Environment Scotland, we would have expected a register to be in place and to be even more important. Across the public sector, we see that a stronger set of arrangements around related parties is featuring.
I wonder whether you would be prepared to go further and suggest that the leadership teams of all public bodies should, if they have a relevant interest, particularly a financial interest, declare it? I do not think that it is unusual to find people in such positions who have an interest, because that is how they have gained the skills or whatever it was that made them valuable for that leadership post. Is this an opportunity to send out a signal to public bodies across Scotland that, if their leadership teams have any interests, it is in their interests to declare that and be clear and transparent?
We would be happy to support that. It is certainly worth engaging further on that with the Scottish Government.
Thanks for that.
The next area that I will probe a little further, although it has already been covered quite a lot, is the arrangements around the electronic purchasing cards. We have talked already about the huge amount of money that was spent on those cards and the limit that was raised to more than £1,200, which seems to me an incredibly high limit for someone spending on their own initiative. As members of the Scottish Parliament, we can have a Parliament credit card, but every single payment, even if it is only £20, has to be signed off and checked by somebody else, so £1,200 seems to be a bizarrely high limit for payments. There seems to have been a complete lack of control, even if the policy had been followed, which, as we have heard, it was not.
I agree with that assessment. There are a few things for the organisation to consider as it evaluates and, in due course, updates its arrangements in relation to the necessity for that volume of purchasing cards to be in place, the transaction limits and the volume of credit limits on the cards. It is also about the extent to which compliance checks are carried out. I am familiar with the level of scrutiny that MSPs’ expenses are under. As we say in the reports, by contrast, around 8 per cent of e-PC transactions each month were subject to compliance checks.
There are perhaps two points. One is about asking whether, if HES has such a volume of cards in place, it can sufficiently exercise compliance against the volume of transactions that are taking place. As the annual audit report notes, the focus had been on whether there was sufficient supporting documentation in place, rather than on whether purchases complied with the policy for items of expenditure. That is an area of necessary review for the organisation. The second point is about considering how goods and services are being procured within the organisation, taking a clear and rational view to support business need and efficiency, and asking whether that is the right number.
You made a point about the policy on what expenditure should be for. The lack of control in relation to that would be a public concern. Purchases may have been made on the credit cards that were not appropriate and that could not have been justified by the organisation, but nobody has been checking what was being spent. I will be mindful of language here, but the public might think that there would be a risk of fraud in the use of the cards. Is there any indication of that being the case, or do we just not know, because there are no controls?
I will bring in Lisa Duthie to say a bit more about some of the transactions that were of particular focus and interest. I have alluded to a couple of them, on accommodation and the kitchen replacement, which felt particularly unusual. We can say a bit more about the detail of that.
As I mentioned in my opening statement to the committee at our meeting on the matter in December, the arrangements bring increased risk in not having a sufficiently robust control environment and a risk of fraud that the organisation was not guarding against sufficiently.
Lisa Duthie can say a bit more about some of the detail and the concerns.
Just to be clear, the purchasing card transactions are subject to approval, and that is part of the basis of our reporting point on the culture whereby policies are not being consistently applied. We see that across different approvers within the organisation.
We refer to compliance with the electronic purchasing card policy. As is consistent with the Scottish public finance manual, any transaction over £1,000 should be supported by three quotes from different suppliers, and they should be written quotes that are obtained and retained and subject to review as part of the approval and compliance-checking process. That information was not available as part of the audit, which made it very difficult, from our perspective, to confirm the appropriateness of the expenditure.
You said that the transactions were being checked.
So, there was at least a second person looking at them. They were not just going through.
That is standard with an electronic purchasing card.
I guess that that gives a little bit of assurance to the public on that point.
Do you want me to continue, convener?
Yes, you have a moment or two, if you have another question.
I will pass back to you.
We will backtrack a smidge. There are one or two technical issues that I would like to clarify with you while you are here, if you do not mind, Auditor General.
I am not sure whether Audit Scotland followed the evidence session on Historic Environment Scotland that was held by the Constitution, Europe, External Affairs and Culture Committee on 6 November 2025. I am sure that you paid attention to it. Some comments were made during that meeting that I would like to reflect on here, and I will ask you for your opinion on what was said. I apologise that I have not provided the quotations for you to look at in advance, but I will do my best to paraphrase, if that is helpful.
In that meeting, the Scottish Government’s director for culture and external affairs, Mr Hogg, was asked about the issues around the appointment of the interim accountable officer. I ask you to reflect on this response. I am partly paraphrasing, although we may put the full quote into the Official Report. Mr Hogg said that he was reassured
“that there were no upcoming decisions that required the accountable officer to exercise oversight.”
He said, referring to the former chair of HES, that he had received
“assurances from the former chair that … there were no decisions that required the accountable officer to be in place.”—[Official Report, Constitution, Europe, External Affairs and Culture Committee, 6 November 2025; c 7-8.]
He does not say whether he was satisfied with that response. Is it normal practice to decide whether there should be an interim accountable officer on the basis of reassurances that there is no need for one because there are no decisions to be made? That sounds like an extremely unusual reason for not appointing one.
Indeed. As you said, convener, I do not have Mr Hogg’s contribution in the Official Report set out in front of me, but I am familiar with the tone that you refer to.
I reiterate some of the sentiment in my remarks earlier in the meeting. As is set out in the Scottish public finance manual, the duties of the accountable officer in the Scottish public sector effectively mean that they are personally responsible to the Scottish Parliament for the proper stewardship of public funds and for the regularity and propriety of expenditure, ensuring that it is providing value for money and that effective financial management and reporting are in place. Reference is made to the annual report and accounts, which are clearly, but not solely, part of that. There should also be effective governance and risk arrangements in place and the officer will have accountability to the Parliament for those. They may be called to appear before this committee or other committees of the Parliament. While they may be able to delegate responsibility, they retain the accountability. The individual transactions referred to by Mr Hogg are important and they matter, but there is a wider set of enduring responsibilities for an accountable officer to either prepare for or respond to events.
It remains my view that, when it became clear that the accountable officer was going to be absent for more than a month, the Scottish Government ought to have appointed a substitute to give assurance to the board that the organisation was continuing to operate as intended, in line with its strategic plans and framework document, and to assure the sponsor team and, ultimately, the Parliament that the organisation was operating in line with expectations.
10:45
Far be it from me to put words in your mouth, Auditor General, but are you saying, in summary, that the fact that there were no immediate decisions to be made does not replace the need for an accountable officer to exist?
I am absolutely clear on that. Although individual transactions matter, accountable officer responsibilities are enduring throughout the term of appointment of an accountable officer and cannot be distilled down in relation to individual large transactions from time to time.
Does that demonstrate that the Scottish public finance manual was not just not being followed but perhaps had been misunderstood, even by the sponsorship division?
There has been a lot of reference to the fact that the accountable officer, upon her return from leave, was discharging those responsibilities in respect of the annual report and accounts. You would of course expect me to say that the annual report and accounts matter. Those will be laid before the Parliament and are subject to scrutiny, along with today’s report. However, I am clear that the role is more than that, and that it involves a much wider set of responsibilities.
I hope that the point has come through in our reports and in the evidence that you have taken this morning that there was some ambiguity about whether the accountable officer’s period of absence would or would not endure. Regardless, I point out that, as we have seen in other organisations, if there is going to be a known period of absence for an accountable officer, the Scottish Government can appoint interim accountable officers—it has done that before—and we remain unclear as to why it did not do so in this case.
Those are questions that we might ask the Government.
Again, I apologise for quoting directly from the Official Report of the CEEAC Committee meeting, but it is probably easier if I do so. Mr Hogg said that, at one point,
“the board determined that it wished to proceed to appoint an acting chief executive”
and that he
“met the candidate and interviewed them in respect of their suitability”
and took the view
“that the individual was appointable as the accountable officer”,
and he
“told the chair and the board that.”
The next line is interesting. Mr Hogg then says:
“The board subsequently decided not to proceed with that appointment”.—[Official Report, Constitution, Europe, External Affairs and Culture Committee, 6 November 2025; c 8.]
It would seem to be an unusual state of affairs for a recommendation about the appointment of a senior chief executive that has been made by a senior director general of a Government department to be refused by the board. At this point, it comes down to a question of who is in charge. What would be the normal procedure or practice in such a scenario, where there is a conflict of views?
It can vary. It depends on the status of the organisation. Historic Environment Scotland is a charitable, non-departmental public body. Forgive me, but I need to refer to the specifics, and I will turn to Lisa Duthie for more detail about where the responsibility for the appointment arrangements resides.
It seems to be suggested by Mr Hogg that the board is responsible for appointing the chief executive and that the subsequent designation of accountable officer is one that comes from the principal accountable officer—the permanent secretary—to that person, as the chief executive. Lisa can confirm whether my understanding is correct.
Per the framework agreement, that is our understanding of the responsibilities. The appointment of the accountable officer sits with the Scottish Government and that of the chief executive with Historic Environment Scotland. My understanding, convener, is that the individual that you referred to was the board’s suggestion and that the Scottish Government considered that person to be acceptable. I am not clear on what happened, what followed that and why the appointment was not made.
That sounds like a series of events that we might wish to dig into further.
My understanding is that the framework agreement between Historic Environment Scotland and the Scottish Government was renewed at some point in the calendar year 2025. Is that correct?
I think that it was slightly prior to that.
My point is that that occurred in the absence of an accountable officer or any senior leadership in HES.
I will correct that slightly, convener. I think that the framework agreement was approved in October 2024, so the accountable officer would have been in post at that time.
Was that a permanent accountable officer or an interim?
It would have been the permanent one—the postholder who subsequently went on leave of absence.
Is Audit Scotland satisfied with the framework agreement or did you have any comments or recommendations on it?
We would not typically take a view on whether it was appropriate or otherwise. We would recognise that it followed the model framework for non-departmental public bodies. The significant point that we draw out of it is the reference to additional income generation. Paragraph 65 of the framework agreement says:
“Optimising income (not including grant-in-aid) from all sources should be a priority”.
That feels like significant contextual information for the organisation. As we have spoken about with the committee on a number of times over recent months, where public bodies are engaging in commercial practices, they need to have the right structures and policies, and compliance with those policies, so that they can safeguard individuals’ and the organisation’s reputations. Such practices would not have been new to Historic Environment Scotland because it has done that for decades.
Thank you; that is noted.
My final question is a technical clarification. In the CEEAC Committee meeting of 6 November last year, there was a conversation about HES’s scheme of delegation to directors. I presume that that was an interim arrangement so that decisions could be made in the absence of senior leadership or executives. It is unclear to this committee whether that scheme of delegation would take precedent over the requirements of the SPFM.
I will perhaps need to take advice on that and come back to the committee in writing on it. My initial view is that no scheme of delegation would set aside the requirements of the Scottish public finance manual, but that does not preclude the possibility that there may be specific wording in a framework document, a scheme of delegation or a letter of appointment of an accountable officer that deviates from that. If you are content, convener, that is probably something for me to come back to the committee on.
If you are willing to do that, that would be helpful. Thank you, Auditor General.
On that note, I conclude the evidence-taking session. I thank Stephen Boyle, the Auditor General, and his accompanying officials—Lisa Duthie, audit director, and Carole Grant, audit director—for answering the committee’s questions on the section 22 report into HES so comprehensively. The committee will consider its next steps in due course.
I suspend the meeting until 11 o’clock to allow for a change of witnesses and a short comfort break.
10:53
Meeting suspended.
11:00
On resuming—
Air adhart
Cairngorm Funicular Railway