Independent review of Scottish Government's use of mobile messaging apps and non-corporate technology

5. Opportunities missed

5.1 One of the most striking things about conducting this review has been the discovery of an abundance of missed opportunities and early warning signs. Opportunities to be alerted to issues, risks and developments that relate directly to matters of records management, MMA usage and conduct.

5.2 For an organisation clearly so committed to having a robust risk management framework in place, these developments, many in plain sight, should have served as a trigger for further enquiry and action by the Scottish Government.

5.3 It points to a challenge that we all have in this fast-moving environment with emerging technologies. Understanding risk means understanding that there will be new threats and new vectors of attack and to identify and respond to them will require a broadening of perspective from the 'traditional' risk model. Threats, especially to governments, are growing and evolving. Our approach must do the same.

5.4 Appendices 3 & 5 set out a number of examples of such developments which could and should have been identified as part of routine risk management and horizon-scanning and fed into proactive review and response.