Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, April 19, 2018

Official Report 570KB pdf

---

“The 2016/17 audit of NHS Tayside: Financial sustainability”

Agenda item 2 is an evidence-taking session on the 2016-17 audit of NHS Tayside. I welcome our first panel of witnesses: Caroline Gardner, the Auditor General for Scotland; and, from Audit Scotland, Fiona Mitchell-Knight, assistant director of audit; Claire Sweeney, associate director; and Bruce Crosbie, senior audit manager.

I invite Colin Beattie to open the questioning.

Auditor General, in the past, I have raised the question of the capability and the appropriateness of internal audit in its present form. We seem to have another problem with internal audit. There is a history of such problems. We have had issues at NHS Grampian, NHS 24, Coatbridge College and Edinburgh College, where internal audit, although it seems to do its job, does not pick up what is necessary. Now we have the situation at NHS Tayside. Is there a problem here?

I think that, in this case, it is premature to conclude that the problem is with internal audit. The evidence that is available to us so far—clearly, the investigation is still under way—is that internal audit raised concerns about the retrospective transaction on the endowment fund, which is what I assume that you are referring to, and that those concerns were not acted on by the trustees of the fund at the time.

We know that the Scottish Government has asked Grant Thornton to continue its investigative work to look at the transaction, following on from its work on e-health funds that you took evidence on before the Easter break, and I would prefer not to comment on the role of internal audit until then. However, it is clear that there was a breakdown in the governance more generally, and I am looking to see what advice the trustees took before taking a decision about the use of endowment funds back in 2014 before I draw any conclusions about that.

It is clearly not just a question of the endowment funds; the situation with the e-health funds raises questions about internal audit. For example, when Lesley McLay appeared before the committee as a witness, she said that she was not aware that the e-health funds were within the deferred expenditure and that she had not asked about that

“Because there was never any risk identified to me or to the board.”

She went on to say:

“We rely on internal audit to review our allocations, and there was never any risk identified that there were inappropriate allocations coming into our board.”—[Official Report, Public Audit and Post-legislative Scrutiny Committee, 29 March 2018; c 26.]

Was her expectation reasonable? Should she have expected internal audit to be able to alert the board?

Lesley McLay’s expectation was clearly reasonable. I am pausing before drawing the same conclusion that you are because the Grant Thornton review makes it clear that the allocation letters, which go from the Scottish Government to each health board with the allocations, did not make it clear that the funds were either ring fenced for e-health purposes or were repayable in the following year. Without that clarity, it is difficult to see how internal audit could have raised the matter as a risk, or how the board members could have known.

The Grant Thornton report makes it clear that the former director of finance was aware of the issue, as was the director of finance of NHS National Services Scotland, which arranged for the allocation changes to go through, but that the conditions on the allocation for e-health moneys were not clear on the allocation letters, which would be the basis on which internal and external audit would look at the matter to make sure that the revenue recognition was accurate in the annual audit of the financial statements.

Are you aware of whether internal audit reviewed how the deferred expenditure account was made up and what its component parts or contents were?

I invite Fiona Mitchell-Knight or Bruce Crosbie to pick up that question.

From an external audit perspective, there are two issues with the deferred expenditure: the accounting and the financial sustainability. From the accounting perspective, the deferred expenditure is included in the board’s income in an appropriate way and in compliance with the accounting rules. We are satisfied that that was the case in 2016-17, which is the period that we have carried out the audit on.

The bigger issue is what that means for the financial sustainability of the board, because it was relying on non-recurring funds. Both Audit Scotland and internal audit have reported on the risks that such reliance brings to the board—indeed, those risks were identified in the Auditor General’s report to you that was discussed in October.

On the endowment question, do the internal auditors receive copies of the board minutes?

Do you mean the board minutes or the fund minutes?

Either.

They would certainly receive the board minutes; I assume that they would receive the fund minutes, but I ask Bruce Crosbie to confirm that for you.

Yes, our understanding is that they receive the fund minutes, too.

So the internal auditors would have received the minutes of the meetings at which the endowment issue was discussed and at which the action was taken that we are now aware of. Would it not have been reasonable for them to have read those minutes and said that what was happening was a problem?

Our understanding is that the internal auditors raised their concerns about the retrospective transaction back in 2014. The matter is also included in the external auditors’ report—both in the body of the report and in the executive summary—so the concerns have been in the public domain for some time.

The question that is of concern to us is the advice that the trustees of the fund took before approving the transaction, but there was disclosure in the annual audit report and—as a result, I think, of the internal auditors’ involvement—in the governance statement of the board’s annual report itself.

I am struggling with the concept that this has all been in the public arena but no one has picked it up. You say that the internal auditors raised the matter as an issue. I presume that they raised it with the board. Therefore, the board was part of the problem, if you like. How does this work?

That is a very good question. As you say, the matter was raised in 2014 by internal audit and external audit. I have reported on the financial pressures on and the financial sustainability of NHS Tayside to this committee each year for the past three years—2014-15, 2015-16 and 2016-17. In my annual overview reports, I have highlighted the perverse incentives and the narrow focus that health boards are taking to land on their revenue resource limits each year instead of looking at their broader sustainability. There is a significant question about why warnings from auditors are not being taken seriously throughout the national health service system. You would need to ask people in the Scottish Government and the board why that is the case.

The external auditors presumably look at all the reports and so on from internal audit; I presume that they work closely together. What did the external auditors do when saw the transaction?

First of all, it is important for me to be clear that the external auditors do not audit the endowment fund. The fund appoints its own auditors, who are not within my remit as Auditor General.

Can I interrupt on that point? There was evidence of a concern from internal audit. Surely the external auditors would have picked that up and developed it.

They did. I am starting off by clarifying the formal responsibilities. I appoint an auditor to the board. The endowment fund appoints its own auditors.

Since 2014, the accounts of the endowment fund have been consolidated within those of the NHS board because of—to put it in lay terms—the degree of overlap between them. You are probably aware that the trustees of the endowment fund are the members of the health board, who are appointed by the Cabinet Secretary for Health and Sport. They are the same people, sitting in a different capacity. To carry out that consolidation, the auditor of the health board issues a questionnaire and instructions to the auditor of the fund, which ask them for a number of pieces of information about the board minutes, the significant transactions that were made and any unusual transactions.

As a result of that, the auditor of the health board included in their annual report for 2014 a clear statement about the retrospective transaction and the extent to which the board had relied on transfers from the endowment fund during 2014 to balance its books. That was the first year in recent times that NHS Tayside had required brokerage and that was part of the same picture. However, because the auditor of the health board is not the auditor of the endowment fund, it is not their responsibility—and, indeed, they have no locus—to examine the advice that the endowment fund took before approving that transaction. That is a matter for the auditors of the endowment fund and, indeed, the fund’s trustees, who have specific responsibilities under the charities regulations for acting in the fund’s best interests. I understand that the review that the Office of the Scottish Charity Regulator is currently carrying out will explore that.

I realise that the endowment fund does not fall within the audit programme. However, internal audit raised the issue. You say that external audit picked that up and took action on it, but the problem just seems to have popped out recently even though it has supposedly been in the public arena for some years.

There is no “supposedly” about it. I have the annual audit report here. It has been on our website and NHS Tayside’s website since June 2014 and the matter is clearly reported in there. The issue that has arisen now is whether the members of the board were acting properly as trustees of the endowment fund in approving that transaction, what advice they took and whether they were aware of the concerns that I understand that internal audit had raised. As far as I know, there is at this point no concern that the transfer was illegal. It was a regular transaction and the auditor reported it in that way as an unusual transaction that played into the growing picture of financial pressures at NHS Tayside.

Everybody claims that they did their job, yet we are where we are. Is the audit function broken? Should the way in which we handle internal audit, and perhaps even aspects of external audit, be reviewed?

You will not be surprised to hear my view that this is not about the effectiveness of audit. The matter was reported in the external audit report. Internal audit raised concerns. The question is why the trustees of the endowment fund did not respond to those concerns when they were reported. OSCR is considering that.

For me, the issue that is raised is whether there is an inherent conflict of interests in the fact that the trustees of the endowment fund are the same people as the members of the NHS board. The Scottish Government considered that back in 2013 when it produced its guidance for endowment funds and concluded that there was no inherent conflict of interests. That question is now back in play, given what we have seen in Tayside and the concerns that are being raised. The question is whether, particularly when health boards are under financial pressure, trustees are able to separate their responsibilities as trustees from those as members of the health board.

That is a fair question, which I hope that OSCR will address in its report.

At the beginning of my questions, I gave a list of occasions on which I believe that there have been failures in the audit system—times when problems arose that audit did not pick up because that was not part of the process or for some other reason. Is audit a chocolate fireguard?

09:15  

Not at all. It is important to be clear what audit does. It does not substitute for the responsibilities of management and board members who are charged with governance in making sure that they have proper checks and balances in place, and that they follow the corporate governance requirements and comply with the Nolan principles. External audit provides a way of reviewing the extent to which those checks and balances are being applied and reporting that to the appropriate body. In the case of the bodies in my remit, the appropriate body is this committee, which is why we have been discussing the matter.

Auditors do not have stop powers—they cannot stop people doing things that they think are inappropriate. The power that we have is that of public transparency and exposure, and the fact that we are discussing these things is a marker of the system working, not of it being broken.

I have one last question. Given the scale of the financial issues that we are facing at NHS Tayside, are you satisfied that at no point was any undue pressure put on the internal auditors to go easy on any of their audit processes?

I cannot give you that assurance. I know that internal audit raised some concerns and that, in the case of the endowment fund transaction, those concerns were not listened to. I do not know what pressure might have been applied, but I think that it is a worthwhile question to ask.

To follow up on Colin Beattie’s line of questioning, the issue to do with the endowment funds came to light in a story in The Herald written by Helen McArdle. She said:

“internal auditors from NHS Fife and Forth Valley questioned how endowment fund cash was being used, but were warned they risked losing their contract with NHS Tayside unless they backed off.”

What is your reaction to that?

I have seen the press coverage. It obviously informed my response to Mr Beattie’s question. I do not have evidence either way of whether the internal auditors were put under pressure. I expect that that is one of the issues that the second phase of the Grant Thornton review will explore. It is worth noting that it relates to one of the differences between internal and external audit, certainly in the Scottish public audit system. Internal auditors are appointed by or are part of the body to which they provide services. External auditors are appointed by me to bodies in the health service and the other bodies for which I have responsibility, which means that that sort of pressure cannot be applied in the external audit world in the same way that it potentially could be in internal audit. That is an important distinction.

If what I read out was true, I take it that you would see that as unacceptable.

Completely. Internal audit is there to provide assurance to those who are charged with governance. It is intended to have a degree of independence to report directly to the audit committee, not simply through the chief executive. Although there is always a discussion about the factual accuracy of an issue, at the end of the day it is for the auditor, internal or external, to make their judgment and to report it without fear or favour.

I would like to follow up on some of Mr Beattie’s other questioning. In your opinion, did the trustees of the endowment fund at NHS Tayside comply with the Nolan principles at the meeting in 2014 at which they suspended the constitution?

It is premature to conclude that they did not. I know that a lot of concern has been raised publicly about the fact that the funds were spent on a computer system. If we step back and look at the purposes and charitable objectives of all the endowment funds, they are quite broadly drawn. They are about providing support for health services and they are very close to the objectives of the NHS in the same legislation—the National Health Service (Scotland) Act 1978. The guidance that was produced in 2013 by the Scottish Government added a proviso that said that trustees should be careful that they are not substituting for core health services, and that clearly comes into play in what we currently know about the retrospective expenditure on information technology systems. The other concern that I have is that it was retrospective, rather than being part of a planned programme of expenditure of endowment fund moneys.

The review that OSCR is carrying out will look at whether, for example, the trustees took their own legal advice, separate from that of the board, about the use of funds for that purpose, and at the question that we have explored about whether they took advice from their internal auditors in the way that I would expect them to.

I do not think that any of us is clear on when OSCR is expected to report. Do you know?

We have a letter from David Robb. I will ask one of my colleagues to check whether it contains a date. It probably does not have an explicit target date.

If it is the same letter that the committee has, I do not think that it has a date. Perhaps we can check that after the meeting.

You said that it is now an open question whether endowment fund trustees should be the same people as board members, who are under pressure to reduce a deficit or balance the books. As Auditor General, is it your opinion that there should be a separation between endowment fund trustees and board members on health boards?

That is a matter for OSCR and for the Government, but my view is that this case shows the risks of having a set of individuals working in two separate capacities at the same time. It is easy to agree in theory with the conclusion that was reached in the Government’s 2013 guidance that, with proper processes, there need be no conflict, but when we are in a situation where all boards are under significant financial pressure, it is difficult to maintain that separation in practice.

Is that 2013 guidance good enough? Some trustees tell me that, when they are presented with decisions on whether something is charitable spending or core funding, it is sometimes difficult to make that call. Is the 2013 guidance strong enough?

I completely agree with trustees that it is hard to make that call. As I said, the charitable purpose and objectives of endowment funds are, in many ways, exactly the same as the objectives of the NHS. Endowment funds are not only for the extras or patient comforts or the sorts of things that people might assume that they are for. For example, it is common for people to make a donation for a specific piece of medical equipment such as a magnetic resonance imaging scanner. It is not an easy separation to make, which is another reason why it might be worth reconsidering whether trustees should be different people from board members, or at least whether there should be an independent element in the make-up of the fund’s board of trustees.

Correct me if I am wrong, but I understand from press coverage that £4.3 million was transferred from the endowment fund to NHS core funding but £2.71 million was spent. The cabinet secretary and the new chair of NHS Tayside have said that the endowment funds will be paid back. How much money would you expect to be paid back—the £4.3 million that has been transferred or the £2.71 million that was spent?

In 2014, the amount that was funded retrospectively on projects that Tayside health board had commenced was the £2.7 million. During the year, the amount transferred was larger, and I do not know how much of that was spent or not.

It is worth being clear that we have been closely following events in Tayside, including the board meeting last week, in which the board agreed to repay the money to the endowment fund. As the auditor of the board, Fiona Mitchell-Knight has asked it for a range of information, including the legal advice that it has taken on its ability to make that transfer from health service funding to the endowment fund, the specific statutes that it is relying on and its process, including the paper that the board considered and the minute that it has taken. We are still considering how that transaction can be made in a way that fits with the board’s powers and responsibilities.

I am not 100 per cent clear on that. If the £4.3 million has been taken from the charitable fund and put into NHS core funding, the people who have raised that money and given so generously would probably expect the £4.3 million, and not just the amount that has been spent, to be returned. Is that what you are saying should be transferred back?

That is why we want to see the board paper that was considered and the legal advice that the board took in considering that decision. At the moment, we do not know the answer. Fiona Mitchell-Knight and Bruce Crosbie were not at the board meeting last week. We have not yet seen the board agenda paper, which explored the proper course of action for board members to take, or the minute of the meeting.

Okay—we can come back to that.

Last week, we looked in some detail at the undetected e-health funds—the £5.3 million that was “obscured”, to use Paul Gray’s language, in the accounts. Lesley McLay stated that she was not aware of it and the former chair, Professor Connell, said that the £5.3 million had been broken down into chunks that were almost de minimis, so they would not be picked up. Would you expect a higher level of scrutiny by either the management team or the board in those circumstances?

I would expect two things that seem not to have happened here. The first is for the allocation letters that go from the Scottish Government to the health board to be clear about the purpose of the funds that are being transferred and any conditions that are attached to them, including whether they are intended for the benefit of boards other than simply NHS Tayside and whether they are due to be repaid in the following financial year.

Secondly, I would expect the director of finance, who holds a significant and responsible position within the corporate governance of the board, to make that clear to the management team and the board as part of the financial reporting. On the basis of the report that Grant Thornton has produced, neither of those things seems to have happened.

I will come back to the director of finance shortly, if I may. We heard quite a lot of evidence about how difficult it might have been to pick up those funds in the accounts. Will you make clear whether the management team and the board should have detected the funds? Would it have been possible for a management team and board to do that?

I think that it would have been hard to do, given the lack of detail and information in the allocation letters. I ask Fiona Mitchell-Knight or Bruce Crosbie to tell you more about what they see as they carry out the audit, given that revenue recognition is one of the significant risks that any auditor has to look at as part of their work.

The accounting rules on income for boards say that the income that is included in the boards’ accounts should agree with what is seen in the Scottish Government funding allocation letters, so those letters are our prime source of evidence for looking at what income should be included in the accounts.

For the 2016-17 audit, we checked those letters and found that they do not say anything about any of the funds not belonging to Tayside, and nor do they mention any requirement for the funds to be repaid. There was no way that we could identify from those specific letters that that was the case, and nor could we expect the members of the board or management team to identify that.

Of course, we were not aware of the discussions that were on-going behind the scenes between the directors of finance and the e-health group, which are discussed in the Grant Thornton report. We had not seen any of those emails or any other evidence that would lead us to question anything in the allocation letters.

Was the drafting of the allocation letters unusual, or is this a structural failing that needs to be rectified?

I think that it is a structural failing. In my annual overview reports across the NHS since 2012, when I took up this job, I have reported on the narrow focus that boards have on hitting their financial targets on 31 March. There are an awful lot of changes to the allocations that boards get during the year—and indeed after the end of the financial year—for different purposes, so there is an underlying concern that it is not easy for boards to know how much they have to spend, potentially until after the financial year end.

In this particular case, we know from the Grant Thornton report that it suited both NHS National Services Scotland and NHS Tayside for allocations to be moving in that way. The directors of finance of both bodies appear to have been aware of that, because it removed a surplus from NSS and helped to reduce NHS Tayside’s deficit. However, because of shortcomings in the way that the allocations were managed, that was not apparent to anybody else, except the directors of finance in those organisations and potentially a small number of more junior team members.

Might a differently constituted board have picked up the issue? For example, the board of NHS Grampian seems to be performing rather well, which is one of the reasons why we have some changes going on at NHS Tayside. Might a high-performing board such as NHS Grampian have picked up this sort of thing?

09:30  

As Fiona Mitchell-Knight said, it would be very difficult for any board to do that if it was being misled by its director of finance. Directors of finance hold a significant responsibility. They have professional and ethical responsibilities by merit of being members of their professional accounting bodies. They have personal responsibilities in relation to the corporate governance code and the financial reporting manual. If they are not making that information available to board or management team members, it is difficult to see how the board can be expected to overcome that.

I am going to recite the narratives that I am hearing and that I heard last week. You have just talked about the board being “misled” by the director of finance, and Paul Gray talked about “deliberate obscuring”. The narrative that I am getting does not quite make sense. The then director of finance was long-serving—he had been there for about 35 years—very senior and experienced, and very close to retirement, and yet, without referral to his colleagues, including a chief executive officer and former chief operating officer with whom he had worked for a long time, he apparently deliberately obscured that transaction. It is a process from which he derives no financial benefit and that delivers no benefit to NHS Tayside, because we heard from Paul Gray that brokerage would have been extended and there would not have been a problem with that, so nothing is apparently achieved. Effectively, the FD goes rogue for no reason. Is that credible?

I cannot speak about the motives or rationale for the director of finance’s behaviour. All I can go on is what is in the public domain, both in relation to the e-health moneys over the past few weeks and going back to 2013-14, when auditors first started—in the time that I have been in this role—to raise significant concerns about the financial pressure that NHS Tayside was under. NHS Tayside first received brokerage in 2013-14. That is not terribly unusual—a number of boards require brokerage from time to time—but, since 2013-14, NHS Tayside has needed and received brokerage every year. More than most boards, it has been resorting to short-term measures to bring its budget into balance at the end of each financial year.

It is important to be clear that, as I have said in my overview reports every year since I have been in this job, in my opinion, the fact that NHS boards take very seriously the need to balance their budget almost to the penny at the end of March each year gets in the way of more strategic and important longer-term financial planning that would help to address the underlying causes of some of those pressures. I think that that climate, rather than any sense of personal gain, may help to explain the actions of the director of finance. It is about the premium or focus that is placed by the Scottish Government, and more generally in the public debate about health boards, on health boards balancing their books rather than having a sustainable financial strategy for the longer term.

I appreciate that it is a difficult question to answer, but is it credible that the director of finance did all of that and did not at any stage say to anyone else in the organisation, “This is what I am doing to achieve the end game that we require.” Is that credible?

That is a very broad question. Again, it is difficult for me to comment on people’s motivations or what may have been known. We know that it would have been very hard for members of the management team or board to have been aware of what was going on with the e-health funds. Revenue recognition is one of the key risks that auditors plan their audit work around each year—they look for evidence to ensure that the income is properly stated in the accounts.

For five years now, individual auditors—and I, at a national level—have been reporting the measures that people right across Scotland take to balance their books, such as by deferring expenditure, making non-recurring savings and, from the Scottish Government’s point of view, redistributing money through late allocations to bring boards into balance. All that means that it is possible that the way in which a relatively small amount of money—let us not forget that, in 2016-17 the amount of e-health funding involved was £2.6 million—may not have been apparent to more senior people in the organisation. I do not know whether people who were more junior in the finance team knew about it, but I suspect that they may not have understood its significance or have had the whole picture so as to be able to see it in that way.

Auditor General, you have referred to the behaviour of the former director of finance. Do you have any evidence that he did not share the information about the e-health deferred funds, apart from what we heard from Paul Gray and Lesley McLay at the previous committee meeting?

The evidence that I am founding on is the report that was commissioned from Grant Thornton to explore the specific issue of e-health funding, in which it explicitly reached that conclusion.

Did it reach the conclusion that the director of finance had not shared that information?

I think that the way that it phrases it was that it would have been very difficult to see how other members of the board could have been aware of it. Again, that report is available to the committee.

The committee is clearly concerned to know whether the problem is one of the behaviour of particular individuals in NHS Tayside or particular elements of governance, internal audit, the board’s audit committee or the finance director, as Mr Kerr asked about. Does the problem relate to NHS Tayside or to the wider NHS system? Is it fair and reasonable to say that, in your previous answer, you suggested that what happened was not an attempt at personal gain by anybody but perhaps an act of desperation to make a budget look as though it had been balanced when, in fact, it was not possible to do so?

Yes, I am very clear that there is no question of personal gain. It is difficult to understand the issue without understanding the context of general pressure and concern about delivering a balanced budget in each health board across Scotland. There was a situation, which had been building since at least 2013-14, of that being increasingly difficult to do. If we set that alongside what we now know are shortcomings in the process by which the Scottish Government allocates resources to individual boards, my sense, which is informed by the Grant Thornton report, is that the director of finance at NHS Tayside was able to use that to make the position appear better than it was.

As you have done previously, you spoke about measures to balance the books in order to meet the short-term requirement to balance funds across boards and across Scotland. Is it true that the pressures that we can perhaps surmise have led to the behaviour in NHS Tayside are prevalent in other boards across Scotland?

I have been reporting on that since I took this job. In 2012-13, which was the first year for which I had responsibility, almost no boards—I will not say that it was none—failed to meet their resource limit targets, but that was done at the cost of an awful lot of short-term measures, such as deferring expenditure, making late allocations and finding non-recurring savings, which gave the appearance of a balanced budget but did not address the underlying problems.

Earlier, in response to Mr Beattie, you said that, throughout the system, auditors’ warnings are not being taken seriously. By that, did you mean across the NHS throughout Scotland?

I meant two things specifically. One is that, in NHS Tayside, such warnings have been sounded very clearly since 2013-14. In relation to the system as a whole, since I took up this role in 2012, I have been saying that about the pressures on the NHS beyond that. The overview reports contain information about the measures that are being taken in other boards, but I would prefer not to be specific about those without referring to the factual content of the reports.

Is it fair to say that NHS Tayside is the canary in the coal mine? Is it the place in which such pressures have led to the problems that we have seen and are now dealing with, and that the Cabinet Secretary for Health and Sport has had to deal with by using her special powers? Is it an indication of problems that could arise elsewhere?

It is not straightforward to draw that direct line of conclusion between the two. There are particular circumstances in Tayside that have made the pressures on the board more acute—the committee has taken evidence on that on a number of occasions over the past couple of years. They are to do with NHS Tayside’s expenditure on drugs and agency staff and the property portfolio that it holds. Equally, over the past five years, I have reported on the extent to which most boards are relying on short-term measures to balance their books.

The e-health money and the endowment fund are two separate issues and there are two separate sets of circumstances. What happened with the e-health money appears to be a result of the deal that was done between the finance director of NSS and the finance director of the Tayside health board, neither of whom was going to gain personally. The deal was done to try to shore up the appearance of robustness in the Tayside health board budget, and it solved a problem for NSS because it did not appear with a big surplus at the end of the financial year.

Are you sure that similar deals on e-health money or anything else with a similar impact of covering up what is going on in the health service’s financial system have not been done between NSS and other territorial boards—or, indeed, between any of the other non-territorial boards and a territorial board? Having been a health secretary and knowing how those bureaucracies work, I find it hard to believe that it was a one-off deal.

At this stage, I cannot give you that assurance. As you can imagine, the auditor of NSS will look closely at the other special-purpose funds that it manages and distributes, and the auditor of the Scottish Government will examine the way in which the health directorate looks to improve the allocations process and understand what might have happened under the process as it stands.

However, the issue is part of the wider question about the pressure to meet short-term targets rather than manage long-term sustainability. I would like the Scottish Government and individual health boards to shift the focus away from how much they need to save to hit their revenue limits on 31 March towards asking whether they understand their finances over the next five or 10 years and what measures they are taking to ensure that they are sustainable.

When, roughly, will that work be complete? When will the committee know whether there were any similar deals, possibly covering other territorial and non-territorial boards, possibly covering issues other than e-health and possibly including other e-health deals?

The NHS director of finance is carrying out her own review as a matter of urgency to consider those other funding streams and how the allocations process can be tightened. We will pick up the issue as part of the annual audit for 2017-18 for all the boards for which I am responsible. Those audits are due to be completed by 30 June. There is obviously a bit of interplay between those two processes.

Whether similar deals have been done across the board is a specific issue. It seems to me inevitable that other deals will have been done that have not come to light so far. As a former health secretary, I do not believe that the Tayside deal was a one-off.

As I said, I have reported over a number of years that late allocations have been used for purposes that appear to have the primary rationale of levelling out underspends and overspends between boards. We know that it has happened. The question that now needs to be answered is slightly more difficult: whether there are any hidden streams of funding that are small in relative terms but significant in absolute terms. Uncovering those might take a little bit longer, but we as auditors and the NHS director of finance are looking at that as a matter of urgency.

You mentioned the auditors of NSS and the Scottish Government. Will you say who they are?

As you know, I appoint the auditors to all the NHS bodies. In the case of the Scottish Government, I sign the account myself and I appoint a lead auditor to undertake the work on my behalf. NSS is also audited by an assistant director from Audit Scotland, who is the same person who leads the Scottish Government audit, so there is a good degree of interaction.

09:45  

I want to go back to the interim arrangements at NHS Tayside. First, I have the highest regard for Malcolm Wright, who is one of the best officials that I came across anywhere in Government. I have total confidence in him as a very competent individual. However, he is chief executive of the northern region of the national health service; he is also chief executive of NHS Grampian, which is not without its own difficulties; and he has now been appointed as acting chief executive of NHS Tayside. How on earth will he have any time to deal with the problems in Tayside when he is holding down three very important jobs simultaneously?

I share your concern, Mr Neil. As I have, you will have seen the information in Paul Gray’s letter about the arrangements that are in place for the deputy chief executive at NHS Grampian to take on additional responsibilities in that board to free up some time for Malcolm Wright to focus on NHS Tayside. However, none of those are small, part-time jobs that would leave lots of time and energy for other things. I assume that the Scottish Government is quickly looking to resolve the question of the long-term leadership of NHS Tayside, which is a question that you would need to address to the Government.

What is the definition of “quickly”? I have concerns about this. I think that the job requires somebody who has no other responsibilities in any other organisation. The chief executive is the key person to sort out governance, yet that is not a clever governance arrangement. In fact, it is very high risk.

I share your regard for Malcolm Wright and your concerns about the stretch that that would place on any individual, however competent and experienced.

Secondly, on the other interim arrangements, what is the current status of the former chief executive?

My understanding is that Ms McLay is currently off sick.

Was she off sick before she was told to stand down?

Those are questions that you would need to direct to the Scottish Government.

My concern is that, yet again—we have been through this with the Scottish Police Authority, big time—we have a chief executive who has been told to stand down and who, it would appear, has then gone off sick, getting their full salary, presumably. The issue of severance payments and all the rest of it also comes up. From an audit and governance point of view, are you not concerned about that very unclear arrangement?

I do not know the timeline of actions and events surrounding Ms McLay over the past few weeks, since the issues have been in the public domain.

It is important to say that, as the appointed auditor, Fiona Mitchell-Knight will be looking in the course of her audit work at any severance payments that come up as a result of that. We know that the former director of finance has departed, and Fiona will be looking closely at the decision making and any financial transactions around that. That will also be the case if Ms McLay leaves the board. Any auditor would want to comment on significant changes and, potentially, significant gaps in the governance arrangements for the body that they audit.

Without knowing more about the particular circumstances, and recognising the sensitivity of that employment issue, I cannot say much more this morning, but it will be an important matter for the auditors to look at.

There is another, related point in relation to the former chief executive. When she became chief executive, she was appointed as a director of the board. Has she resigned or been dismissed as a director of the board, as that is a separate process?

My understanding is that she would be a member of the board as the chief executive, and I have not seen anything to suggest that she has been removed as a member of the board. It comes down to very explicitly understanding what her status is. My understanding is that she is on sick leave, but that is really a question for either the chair of the board or the Scottish Government.

We need to check the current situation. When I was the cabinet secretary, I changed the rules. The irony was that the cabinet secretary had to approve the appointment of every board member except the chief executive, over whom, at that time, the cabinet secretary had no responsibility. I changed that position because an appointment was made on one board with which I strongly disagreed. I had indicated previously that I would strongly disagree with the appointment, but the board and the chair went ahead and made the appointment anyway. They then asked me to sign off that person becoming a director, and I refused to do so until we changed the rules.

We changed the rules because the chief executive appointment is the most important of all appointments, yet it was the one in which the cabinet secretary had absolutely no involvement. We changed the rules so that the cabinet secretary had to approve the appointment of the chief executive but that was a separate legal process from making the appointed chief executive a member of the board.

We need absolute clarification from Paul Gray on all these points. I do not want us to be in a position yet again in which a chief executive is told to stand down because of the governance situation but they are able to stay on full salary for a year before they leave the organisation. I do not want to get into personal issues; it is a governance issue and I am addressing it as such. However, on all these questions, we need immediate clarification from Paul Gray.

We will seek that clarification from Paul Gray. We can discuss that after this evidence session.

Auditor General, I will follow up on one of the questions. For many years—from well before my time on it—the committee has been concerned about severance payments in the public sector, which Alex Neil touched on. We know about the financial mismanagement at NHS Tayside, and you have reported on it for many years in section 22 reports. In your opinion, should the outgoing chief executive receive a severance payment?

It would be difficult to justify a severance payment in the terms that I think you are intending, convener. However, the committee heard in evidence from the former chair and the chief executive of the board before the Easter recess that no severance payment was involved. Instead, the former director of finance chose to exercise his option to retire, given his age and his standing with the board. That is very much the territory that Fiona Mitchell-Knight and Bruce Crosbie will be exploring as part of their audit work, in order to understand the basis on which he left and the basis on which any payments were made. You have my assurance that we will report that information as part of the reporting on the audit, which is due to be completed by the end of June.

With respect, that is about the director of finance. The current situation is that we have a chief executive who we expect will leave the organisation—the cabinet secretary said that her position was untenable and she has been replaced, but she is still an employee. Given the concerns about the use of public money on severance payments in the public sector, would it be appropriate for an outgoing chief executive to receive a severance payment from the public purse?

It is always very difficult to comment on specific cases because there are disciplinary and other potential implications to be considered, as well as employment law to be taken into account. I expect the board to look at the process that it goes through in deciding how to give effect to the request that the cabinet secretary has made in relation to the chief executive, and that is what Fiona Mitchell-Knight will be doing as the auditor.

There are clearly questions that—as far as I know—have not yet been answered. Once those questions have been answered, that will lead to the question of whether any severance payment is appropriate and how it should be made. What I can do is to bring full transparency to what has happened and report to the committee any concerns that I have about the way in which things have been done, as I have done on a number of occasions.

I will ask a few questions that have not yet been asked about the £5.3 million of e-health funding. Do we know whether that was receipted as a single payment initially or whether it was received as separate payments?

It was certainly not a single payment and it was not a payment for e-health. It was an allocation from the Scottish Government to NHS Tayside that did not make clear what it was for or the conditions that were attached to it.

It came in in smaller amounts. There was not a single £5.3 million transaction.

My recollection is that it was split across four different transactions for 2016-17. The full £5.3 million did not come in at once; it was split up.

It came in in smaller chunks initially.

Through the allocation letters—yes. It was split.

Would it still have been described as the same thing? Would the terminology or language in the allocation letters have described it as—

They did not describe it as anything. I think that that is the problem. It was simply described as an allocation of money to NHS Tayside rather than as e-health funding.

I think that e-health was in the description, but there was no indication that it was not e-health funding that was due to Tayside. There was no indication that it was due to other boards or that it was due to be repaid. The descriptions were not clear.

From that point on, there was a further process of splitting up the funds into even smaller units, which, in Mr Gray’s words, was a process that was “intended to obscure” the transactions. Are we talking about the amounts that were received or were they further dispersed and spread out through the year to achieve the effect that we are discussing?

The allocation letters for 2016-17 were split into four transactions, and then that money as a whole was included in the total income that was disclosed in the board’s accounts. It was not actual money in its hands; it was an allocation against which the financial outturn is assessed in order to measure whether the targets have been achieved.

I understand that. What I am trying to ask is, if it came in as four payments, did it then appear in the accounts as 10 payments? Was it further divided to bring it under the £1 million threshold, below which people were unlikely to notice it?

No. It is quite the opposite. It goes into the total income, which is the large numbers on the face of the accounts.

Why did nobody notice it? I think that £5.3 million is a significant amount of money for people not to notice.

It was £2.5 million in 2016-17, and that was part of the overall revenue income of £803.2 million. As Fiona Mitchell-Knight said, the allocation letters did not make it clear either that the funds were not specifically for Tayside or that they were liable to be repaid in the following financial year.

Okay. There has been some discussion about whether the audit process should have picked this up. What do you think? Do we need a different process? It is one thing to say to the boards, “Stop doing that”. It is another thing, surely, to ensure that it is not being done. If the audit process does not find and reveal it, what do we need to put in place to ensure that this kind of thing does not happen? Is it an extra audit process, or does some other internal action need to take place?

The root cause is the system by which the Scottish Government allocates funding to NHS boards. That is the prime source of income that they receive. It is important that boards are clear about what they are receiving, why and any conditions that are attached to it.

The events surrounding e-health funding in Tayside have demonstrated shortcomings in that process. That is very clear from the Grant Thornton report. We know that the NHS director of finance is reviewing that process, and we will look closely as part of our audit of the Scottish Government to see what changes it makes to the process and the extent to which they address the risks that have been identified.

Convener, do I have time to ask a question about the endowment fund?

Yes, but please be brief.

In 2010, OSCR looked at NHS Lothian’s endowment fund management, and it made some recommendations about the separation of duties between endowment fund boards and health boards. Are those guidelines or recommendations strong enough or do we need to review them given what has happened with NHS Tayside?

I go back to the point that the Auditor General made earlier about the need to review the guidance to see whether it is clear enough. Auditors check against the guidance to make sure that organisations are following the rules, but if there is a lot of leeway or a large degree of breadth in how they can be followed locally, it is difficult for audit teams to determine what it looks like when boards’ actions are not falling within those rules. That can happen if it is not clear from the guidance. Part of the process that is happening now is consideration of whether the guidance needs to be clearer, which will, in turn, help the audit process.

Okay. Thank you.

10:00  

I have some brief points of clarification. First, regarding the e-health moneys, the £5.3 million is broken down into chunks of less than £1 million. Has anyone reconciled the accounts such that the allocation letters match what was contained in the ledgers?

That is a core part of the work that the auditors do in every health board. The allocation letters are the prime source of evidence for the income that the board has to spend, which is obviously a foundation of the audit work. The problem is not that the allocation letters were wrong; it is that they did not provide that information about the money being there for more than just Tayside’s use and for it being repayable in the following financial year. That was opaque to everybody apart from the director of finance of NHS Tayside and apparently the director of finance of NHS National Services Scotland.

I will move on to something that Willie Coffey asked about. We have heard about this “deliberate obscuring”; we have heard that the funds were broken down into pots of less than £1 million so that an average board would not pick them up. However, what I just heard from Fiona Mitchell-Knight was that in fact, the sums came in and were collated into a big sum and therefore became much more obvious. Have I misunderstood something?

Let us be clear. In 2016-17, the amount involved was £2.5 million, as set out in the briefing paper that we provided. I think that Fiona Mitchell-Knight was saying that that £2.5 million needs to be seen in the context of the £803 million of overall revenue coming to the board in that year. The additional amount of money that brings the £2.5 million amount up to £5.3 million was money that the board was banking on—it was expecting to receive that money in 2017-18. It has not been part of the overall outturn yet, or indeed part of the audit that is happening.

I think that Bruce Crosbie and Fiona Mitchell-Knight are in a position to give you a bit more information about the way that the money was managed in 2016-17.

The allocation comes into the accounts through the summary of core revenue resource outturn. That starts off with the net expenditure of the health board; set against that is the amount that comes through as the gross allocation from the Scottish Government. We then identify whether the health board has met its target of achieving its revenue resource limit. That only comes into the accounts in a single sum and that is what we then check in the allocation letter from the Scottish Government. The resource accounting manual and the Scottish public finance manual require us to do that to make sure that those two are in agreement. At no stage in the accounts does it break it down to any greater detail than that, so there would be no way that we could evidence any of the amounts within that total sum to the degree that you suggest we could.

We have been concentrating on the financial impact of these decisions, but the whole point is that the e-health money was designed to carry out specific initiatives in relation to e-health, such as developing the electronic patient record and so on and so forth.

There is an important point that we have not talked about. As a result of these deals, is the ministerial policy on e-health being sabotaged in order to reach a deal to cover up a real deficit or a bigger deficit than appears to be the case? What are the implications for Government policy?

One of my frustrations when I was Cabinet Secretary for Health and Wellbeing, particularly in relation to e-health, was that I felt as though, without having an army of people to double-check that things were being delivered, in a lot of areas, things were not being delivered to the front end. Now I am beginning to understand some of the reasons why. I think that we also need to look at this from the point of view that the e-health money was designed to take forward the e-health agenda and clearly that did not happen.

You are absolutely right that that is, in many ways, the important question. It is important to be clear that the reason why the money was available to be transferred to NHS Tayside was because of slippage on the e-health programme.

It is a stretch to suggest that that is due to any attempt to sabotage the programme, but it demonstrates the difficulties in spending that money in ways that achieve the transformation of the health service, which would be one of the solutions to the financial pressures that NHS Tayside and other health boards are under.

I am not suggesting that the intention was sabotage. What I was saying was that the consequence was in effect to sabotage the programme.

It is due to slippage—there is no question of that.

Of course, we have the bizarre situation in which the e-health moneys were being used to deal with the deficit and then charity endowment money seemed to be used for an e-health project.

Auditor General, on the deferred expenditure—the e-health money—you heard me asking the former chief executive at our previous evidence session whether she should have been asking questions about deferred expenditure. Iain Gray also asked about that. In your opinion, should she have been asking those questions about what the deferred expenditure was and how much it was?

Any chief executive and any board should be asking those questions, particularly in a context in which we know that a lot of boards rely on deferred income and other short-term measures to hit their targets. Having said that, it comes back to the point that the director of finance holds a very personally responsible position and has professional and ethical responsibilities, and if the director of finance is not providing straightforward information about those questions it is difficult to know how the chief executive or the board could get beyond that, in the absence of evidence that there is a particular problem. We know from the Grant Thornton report that that evidence was not apparent.

You think that it is a two-way street. The evidence that we heard indicated that the former chief executive was under the impression that it was a one-way street: she was not given the information and, therefore, she did not know about it. In your opinion it is a two-way street: there are obligations on the director of finance to provide the information and obligations on the chief executive to ask those questions.

Absolutely. It is incumbent on any board member—chief executives and others—to ask the difficult and challenging questions. That is what they are there for.

Bill Bowman, you have been extremely patient.

Thank you, convener. My questions are for the Auditor General and Audit Scotland. If it is a different answer for either, please let me know. Are you professionally regulated?

Yes, we are. We voluntarily apply the international standards on auditing, and the audit work that is carried out, whether for the audits that I sign off or those that Audit Scotland staff sign off in their own names, is subject to all the requirements of the international standard on quality control—ISQC1—and the broader requirements that are there. We are not subject in a formal sense to review by either the Financial Reporting Council or the recognised supervisory bodies, but as of the last audit year we have voluntarily appointed one of the RSBs to oversee the audit work, in order to provide me, as Auditor General, the Accounts Commission and the board of Audit Scotland with assurance about the quality of the audit work.

I would interpret that to mean that you are self-regulating.

We are not self-regulating in that we have now appointed an arm’s-length RSB to work independently to carry out the same reviews that they do of other firms and to report them in the same ways.

But you appointed them yourselves.

Yes.

So, if somebody was dissatisfied with your work in a way that, if it was a commercial audit firm, they could go to the regulator, can they go to somebody to ask them to investigate you?

They would come to me and the board, and we would provide them with the evidence that we have about the quality of the audit work. As it happens, in the first round of the audit review that was carried out by the RSB, the NHS Tayside audit was one of those that came out as a 2A grading, which means that only limited improvements are required and it meets all of the relevant professional standards.

I would still interpret that as being self-regulating. You are not statutorily regulated.

In a formal sense, yes; but we have done everything that we can to ensure that we are meeting the same standards, because I have a very strong professional commitment to the quality of the work that we do, as you would expect.

I understand that, thank you.

On the question of the audit of the endowment funds, you distanced yourself from that, but you also said that they are included in the consolidated financial statements. To me, that means that you have an audit responsibility over those funds, regardless of who did the audit. Can you just clarify that you take responsibility for those audits?

It is not quite accurate to say that I distanced myself from it. As a matter of fact, I do not audit or appoint the auditors to the endowment funds; under the charities regulations, they appoint their own auditors. It is also the case that, as I have said, since 2013, the endowment funds have been consolidated within the board accounts, and the auditors follow the requirements of the international standard on auditing—ISA 200—in doing that.

But you said that you may not have the right to get certain information.

No, I said that we do not have the same access to a body or fund that we do not audit as we do to the ones that we audit, but we—

But you must judge that that is not a limitation on your scope because there is no comment in the financial statements.

Absolutely. We apply ISA 200. Fiona Mitchell-Knight and Bruce Crosbie will be very happy to talk you through how they do that in relation to the NHS Tayside endowment fund.

Okay—thank you. I have previously asked questions—I think it was on the SPA audit—where we have a clean audit opinion on the financial statement followed by quite damning section 22 reports. This week in the chamber, the cabinet secretary referred to the financial statements having clean opinions. Is there a misunderstanding among your stakeholders about the meaning of your audit work on the financial statements?

I am not sure that there is, although I think that there is a misunderstanding in this case. My recollection of the Official Report is that the cabinet secretary said that the matter had not been raised by the external auditor. I think that that is incorrect. It clearly was raised by the internal auditor in the annual audit report, which is in the public domain. That is an important difference between the public audit regime in Scotland and the audit regime in the private sector. Public sector auditors have reported in public since the establishment of Audit Scotland and the report has been available on the NHS Tayside website and the Audit Scotland website since the conclusion of the audit. There is a very clear mention of the issue in the annual audit report for 2013-14.

When you talk about an annual audit report, I think of the one on financial statements.

No. I have here a copy of the report on NHS Tayside for 2013-14—

Sorry, but I was talking about the current year.

The same will be true for the current year. In every case, the auditor is required under the legislation to report to the members of the board and to me as Auditor General, and that report is available in the public domain. It contains a very clear reference in the executive summary to the retrospective transaction between the endowment fund and the NHS board.

But it is not referred to in the audit opinion on financial statements.

The audit opinion is a short-form opinion—it certainly was in 2013-14, and is about true and fair view. The transaction does not affect the true and fair view or regularity. The wider annual audit report, however, which is an important part of the public audit regime in Scotland and across the United Kingdom, contains a clear mention of the issue, and it is that which provides the basis for the further reporting that I can do under my statutory powers.

I have one final point.

Be very brief.

Liam Kerr asked who might know about the matter. In my experience, whenever there is a troublesome event, it is never just one person who knows about it. Other audit processes were asked about. For me, it is about using professional scepticism—what you might call an auditor’s nose—to know that something is not right. Did you have no feeling that something was not right at NHS Tayside?

Audit Scotland was not the appointed auditor in 2014.

I am talking about this year.

Oh—I am sorry. In that case, please respond, Fiona.

It has already been discussed that we have reported extensively on our concerns about the financial sustainability and the financial position of the board. That was in our annual audit report, which was then picked up in our section 22 report.

As a result of the issues that have been identified recently on the accounts, the e-health transaction is clearly a misstatement in the accounts, but is not of a material nature. I have already explained how we were not able to identify that because the conditions were not identified in the Scottish Government allocation letters.

The endowment fund issue is not an issue for the 2016-17 accounts; the consolidation into the group was accounted for appropriately.

I thank you all very much for your evidence this morning. I suspend the meeting for two minutes to allow a changeover of witnesses.

10:14 Meeting suspended.  

10:16 On resuming—