Seòmar agus comataidhean

That was useful.

Another thing that jumps out at me is that, when you look at the year-on-year variance in what you have spent across two budget years, the margins of variance are a lot lower. You have said that you think historical spend—or historical track record—is a good baseline for working out how much you want to come and ask for in future years. Indeed, if you did that, you would probably come out with a better outcome, because what you spent in 2023-24 was, in many lines, not wildly dissimilar to what you spent in 2024-25, while, in 2024-25, there is a wild variance between what you budgeted for and what you spent. Perhaps you could reflect on that. After all, you will be coming to us with future budget proposals, and there will come a point at which the commission will have to take a view on the amount of faith and trust that we can put in them, having seen the huge variance in what we have in front of us. Of course, that is more of a comment than a question.

In the interests of time, I will look quickly at some of the other big variants that jump out. The first is the “Other” line—that wonderful catch-all that is always at the bottom of a budget table. The variance in that line is 80 per cent, with a £457,000 underspend. What did you budget for in the “Other” line and then not spend?

Thank you very much for that explanation.

I turn to Vicki Bibby with a question about the IT budget, which the report flags up as having produced another quite big variance between what you asked for and what was spent. It says that the approved budget for IT was about £500,000, but at the end of the year the spend was sitting at more than £800,000, which was a 47 per cent jump. How did that variance come about?

That suggests to me that you are looking at the overall number as the centrifugal point of your budget processes. In other words, you seem to be saying, “Let’s make sure the overall number is there, or thereabouts, so the commission doesn’t come back to us and say ‘There’s been a wild underspend or overspend.’” That is fine, but it relies on some budgets naturally coming way under so that you can go way over on others. Indeed, the numbers reflect that.

On the one hand, your total operating expenditure is considerably higher than was budgeted for, while on the other you have had an underspend in people. Perhaps that is just a matter of luck, rather than something planned. If you had spent what you said that you were going to spend on people, you would have been wildly over on opex.

Is it good enough simply to rest on the top-level number? It is important that we do drill into some of these lines.

To clarify, does that mean that you no longer survey the auditors in external firms and you rely on those firms surveying their own staff?

When this budget was approved, was that change not already known about? The budget would have been approved, based on that information at the time, yet there is still this huge variance.

There was a 20 per cent jump in what was budgeted versus what was spent on external organisations. That is not within the margin of small error; it is a huge variance.

One aspect missing from the table, on which perhaps other members will comment, concerns the IT issues that we have discussed previously. We have had long conversations about your big plans for upgrades and investments, but I struggled to find those reflected in the budget spend for last year. Is that because you have not spent the money, but the work is coming down the line and we will be hit with a big ask next year, or is that spend in there? I heard what you said about laptops and cybersecurity issues. By the way, I am all for spending money on cybersecurity—and I am sure that the laptops are lovely—but given what we talked about at previous meetings I was expecting to see lines on major software or infrastructure IT upgrades that would propel you into the future.

Where would I find information on internal Audit Scotland staff? What level of surveying has been done there? How useful or reliable is the data on their happiness or contentedness with what they are given to allow them to do their jobs?

There is a debate as to why not. It is a competitive working environment and other companies may offer different working practices that are more favourable to people, so you have to stay competitive, I guess.

I am happy to leave it there. I may have other questions on the audit quality later.

If I recall correctly, previous reports on the quality of public audit provided more information on audit inputs from your auditors, including internal auditors and external audit partners. Reports also included useful information from auditors who were surveyed for their opinions on, for example, whether they felt that they were able to carry out a high-quality audit, whether they had all the resources that were necessary to allow them to do their job and whether they were given the appropriate time, training and development to do so. It was quite helpful information, but it has not been included in this year’s report. Why not?

The added element of risk for you is that not only do you hold your own organisation’s data but you deal with large amounts of data from other public sector organisations. Presumably, some of that data is quite sensitive. Will you give us an idea of the scale of the issue? How frequently do such attacks happen?