Skip to main content
Loading…

Seòmar agus comataidhean

Official Report: search what was said in Parliament

The Official Report is a written record of public meetings of the Parliament and committees.  

Criathragan Hide all filters

Dates of parliamentary sessions
  1. Session 1: 12 May 1999 to 31 March 2003
  2. Session 2: 7 May 2003 to 2 April 2007
  3. Session 3: 9 May 2007 to 22 March 2011
  4. Session 4: 11 May 2011 to 23 March 2016
  5. Session 5: 12 May 2016 to 5 May 2021
  6. Current session: 12 May 2021 to 1 July 2025
Select which types of business to include


Select level of detail in results

Displaying 2321 contributions

|

Public Audit Committee

“Planning for skills”

Meeting date: 10 February 2022

Willie Coffey

Auditor General, you tell us in the report that the Government established a skills alignment assurance group but wound it up less than a year after it was established. Can you give us a bit more information on what happened and whether the decision to wind it up was supported by the partners in the arrangement?

Public Audit Committee

“Planning for skills”

Meeting date: 10 February 2022

Willie Coffey

Auditor General, can you say something about the regional dimension of what we have been discussing? You mention in the report that the Government signalled a change to its approach to skills alignment in December 2020. How do we plan locally and regionally—for example, in Ayrshire—to match up skills to emerging economic opportunities? How does that shape up against the training and courses and so on that we offer in our colleges? Can you say a bit more about the regional dimension and what the impact of all your reporting is having on the successful delivery of that?

Public Audit Committee

Section 22 Report: “The 2020/21 audit of the Scottish Environment Protection Agency”

Meeting date: 10 February 2022

Willie Coffey

Thank you very much.

Public Audit Committee

“Planning for skills”

Meeting date: 10 February 2022

Willie Coffey

Good morning, Auditor General and the rest of the panel.

Before I ask a couple of questions about the skills alignment assurance group, I want to pick up on the comment in your opening remarks on the pandemic’s impact on the programme. In paragraph 18, you say:

“From March 2020, much of the skills alignment work was paused to allow staff in the Scottish Government”

and so on

“to focus on the emergency response to the ... pandemic.”

What impact did that have on the entire programme? You go on to say that

“the Scottish Government asked the SFC to review the tertiary education system”

in light of all that. It seems that the impact on the programme was not insignificant, but can you tell us a bit more about the overall impact and whether the review that was initiated in June 2020 has been completed? If so, have you had a chance to assess its effectiveness?

Public Audit Committee

“Planning for skills”

Meeting date: 10 February 2022

Willie Coffey

Has the review completely reshaped the entire skills alignment programme? Has it completely changed how we think about it and what we intend to do? Is it fair to say that it has had a major impact on rethinking the direction of travel for the programme?

Public Audit Committee

“Planning for skills”

Meeting date: 10 February 2022

Willie Coffey

Will you say a wee bit more about that? There has been a skills alignment assurance group, and now there is a shared outcomes assurance group. What is the fundamental difference between the two? Do you have confidence that the new group will be an effective way to monitor progress as we move forward?

Public Audit Committee

Section 22 Report: “The 2020/21 audit of the Scottish Environment Protection Agency”

Meeting date: 10 February 2022

Willie Coffey

The backup data seemed to be targeted at an early stage. I am a wee bit surprised about how easy it was to access the backup systems. From my long experience of working in computing, I would have expected it to be logical for the backup data to be physically separate so that it could not be subjected to that sort of cyberattack. It should be completely protected and separate from the main data, but that does not seem to have been the case here. Should you recommend that SEPA and other organisations look more closely at that, and that they should separate and protect any data that is essential to keeping their business running?

10:45  

Public Audit Committee

Section 22 Report: “The 2020/21 audit of the Scottish Environment Protection Agency”

Meeting date: 10 February 2022

Willie Coffey

Does that give assurance, though? There is bound to be another attempt at a similar attack on an organisation. In my opinion, it is still dangerous to have a direct link to the backup data and servers from the main data and servers. There should be some physical and logical separation of the two so that, if the attack is successful in one part of the operation’s data, it does not succeed in the other. Does SEPA plan to consider that?

Public Audit Committee

Section 22 Report: “The 2020/21 audit of the Scottish Environment Protection Agency”

Meeting date: 10 February 2022

Willie Coffey

Auditor General, one of the lessons from the attack is that the cybercriminal fraternity is a step ahead of the game, despite organisations’ best efforts to have the best systems, including security systems, in place. I imagine that a number of the recommendations try to address that.

The cyberattack is still the subject of an on-going police investigation, but are you able to tell us exactly where the attack managed to penetrate SEPA’s systems—the route source—or will that remain confidential?

Public Audit Committee

Section 22 Report: “The 2020/21 audit of the Scottish Environment Protection Agency”

Meeting date: 10 February 2022

Willie Coffey

That is good to hear. Convener, you will be delighted to hear that, in my day, when I worked in computing, our guys used to put the backup in a case and take it to the bank. We would actually take a hard drive away and make sure that it was physically protected so that, if something like that happened, the information could be immediately restored. There is a lesson from the past in that regard.

My final query is about staff training. It is recognised that SEPA staff were well trained in all those aspects and were aware of them. Are there further plans to improve training in relation to cyberattacks and to make staff more aware of the possibilities and the risks?