Social Security Scotland - internal audit work summary: FOI release

Information requested

You asked for “Under FOISA, please give details of current internal audit work taking place in Social Security Scotland, as discussed in the Portfolio Sponsor Meeting of Monday 11th March 2019”.

When I requested clarification on what detail was sought (on 31/05/2019) you responded that you would like “a summary of the audit activity that has been completed or ongoing or requested -  listing areas being audited and what they are being audited for, and the progress being made...” noting that you were “not looking for the audit reports but a list of the reports produced following on from any audit work would be useful.”

Response

While our aim is to provide information whenever possible, in this instance we are unable to provide some of the information you have requested, specifically, information relating to ongoing and upcoming reviews because exemptions under sections 30(b)(i) and 30(c) of FOISA apply to that information. The reasons why these exemptions apply are explained in the Annex to this letter.

Please see the below table for information on completed Internal Audit activity. As per your request, the information provided below covers the areas audited (and names of the reports), what they were audited for, and the progress status.

Internal Audit Report Name	Scope	Progress
Organisational Strategy – Strategic Narrative and Key Messages	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland’s dissemination of Strategic Narrative and Key Messages arrangements.	Complete
Fleet Management Assurance	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland’s fleet management arrangements.	Complete
Business Planning	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland’s Business Planning arrangements.	Complete
Recruitment	To assess the adequacy and effectiveness of the controls in Social Security Scotland which ensure that the recruitment process, with dependency on shared services, is effective and will result in a large scale on-boarding being feasible.	Complete
Governance Structures	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland’s Governance arrangements.	Complete
Reporting and Assurance Functions: Roles and Responsibilities	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland’s reporting and assurance functions arrangements.	Complete
Development of Key Performance Indicators (KPIs)	To evaluate and report on the controls in place to manage the risks surrounding Social Security Scotland's arrangements for developing KPIs.	Complete

 

Reasons for not providing information - Annex
An exemption applies, subject to the public interest test

Exemptions under sections s.30(b)(i) and s.30(c) of FOISA apply to some of the information you have requested.

Section 30(b)(i) of the Freedom of Information (Scotland) Act 2002 exempts information from disclosure where disclosure would, or would be likely to, cause substantial inhibition of free and frank provision of advice. This exemption applies in this instance as it recognises the need for Scottish Government officials to have a private space within which to discuss and explore issues before reaching a conclusion. We have applied this exemption in respect of ongoing and future internal audit work. We have applied this because it is particularly important that officials contributing to any of the reports covered in this category feel able to provide their advice and/or views fully and freely without fear that their contribution will be disclosed.

Section 30(c) of the Freedom of Information (Scotland) Act 2002 exempts information from disclosure where disclosure would, or would be likely to, cause substantial prejudice to the effective conduct of public affairs. In this instance, we have applied this exemption in respect of all ongoing and future Internal Audit work as staff or stakeholders participating, or likely to participate in the audit, are likely to be reluctant to take part or to contribute fully and candidly if they are concerned that their views may be disclosed subsequently. This would prejudice substantially the audit or review process and undermine its effectiveness because the report/assessment would be based on incomplete or inaccurate information.

This exemption is subject to the ‘public interest test’.  Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption.  We have found that, on balance, the public interest lies in favour of upholding the exemption. 

We recognise that there is some public interest in disclosing information as part of an open, transparent and accountable government.  However, there is greater public interest in protecting the effective conduct of public affairs and ensuring Social Security Scotland is able to conduct this aspect of its business effectively. We believe that, in this instance, the interest is in favour of upholding the exemptions. This is because it is crucial that we do not prejudice the audit or review process and therefore undermine its effectiveness. In order to prevent this happening, we must ensure that officials contributing to reports can provide their advice and/or views fully and freely without fear that their contribution will be disclosed.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.