Seòmar agus comataidhean

The Auditor General touched on my first questions in his opening statement. Paragraphs 8 and 9 of the report state:

“SEPA commissioned independent reviews of the cyber-attack so that it, and the wider public sector, could learn lessons.”

The reviews concluded

“that SEPA had a high level of cyber security maturity, but further improvements could be made”.

They also

“made 44 recommendations for SEPA”

to take forward

“to enhance processes and controls in relation to information security.”

Given that SEPA was found to have a high level of security maturity, 44 recommendations seems to be a lot. How likely is it that other public sector organisations that are also considered to have a high level of security maturity are at risk from a similar cyberattack? Have all the recommendations been passed over, and is SEPA taking action on them?

Good morning. On compliance of Scottish income tax payers, one issue that has arisen during the scrutiny of previous NAO income tax reports is whether any evidence of behavioural effects has emerged as a result of Scottish income tax rates and bands diverging from those in the rest of the UK. In 2020-21, Scottish taxpayers paid more income tax than taxpayers south of the border on earnings of over £27,000, with a difference in excess of £1,500 on those earning over £50,000 per annum. The NAO report states:

“HMRC continues to assess as ‘low’ the risk of non-compliance as a result of divergence between Scottish income tax and the rest of the UK”

and

“HMRC has not identified any significant or widespread instances of taxpayers changing their address to obtain a tax advantage.”

What is the definition of “significant” or “widespread” in this instance?

So it is not causing concern just now, but you are keeping an eye on it.

My other question concerns HMRC. It has limited performance data available about its compliance activities in Scotland. Unlike its income tax system, which flags residents as Scottish, HMRC’s compliance system cannot readily identify people living in Scotland. Therefore, it cannot easily track and monitor compliance activity in Scotland, which affects its ability to collect performance data about the extent of Scottish non-compliance.

Why is there limited performance data and compliance activity in Scotland, and what, if anything, is being done to address that?

We note that the commissioner was appointed as commissioner and accountable officer on 1 April 2019. Paragraph 8 on page 3 of the section 22 report outlines that

“The Commissioner has been on extended leave since early March 2021.”

We also note that the Scottish Parliamentary Corporate Body appointed the public appointments manager as acting commissioner and the head of corporate services as acting accountable officer on 20 April 2021. Do you know the reasons why the acting commissioner is not also fulfilling the role of accountable officer?

That is fine. Thank you.

Okay—thank you for that.

Paragraph 28 of the section 22 report refers to 22 separate recommendations that the external auditor made. Those recommendations can be found in the auditor’s annual audit report, which the commissioner’s office has accepted and is progressing.

We also understand from the external auditor’s annual report that a “separate detailed draft report” by the auditor to management was considered by the advisory audit board in June 2021, which set out its findings and conclusions on each audit dimension. Is that report publicly available?

Good morning, Mr Boyle.

Glasgow Prestwick Airport was purchased by the Scottish Government in 2013 for £1, but paragraph 28 of the Audit Scotland report states that

“loan support provided up to 31 March 2021”

came to a total of

“£43.4 million although this was valued at £11.6 million in Transport Scotland’s accounts ... following an independent valuation.”

Audit Scotland then notes that

“£1.2 million interest charges have accrued during the year resulting in total accrued interest of £6.3 million”

and that

“In keeping with Transport Scotland’s approach in previous years, the interest on these loans has been impaired to nil.”

What is the explanation for the differences in the figures for loan support and interest charges for Prestwick in the Audit Scotland report and Transport Scotland’s accounts?

Thank you for that. What are the financial implications for the Scottish Government of the continued failure to find a buyer for Glasgow Prestwick Airport?

The census programme has been subject to a number of reviews. Challenges were first identified in 2018 and, in March 2019, the programme status was marked as red. Following the implementation of a recovery plan, the subsequent reviews noted significant improvements. A review in February 2020 gave the programme an amber rating and concluded that the census would have been able to proceed in 2021 had it not been for the pandemic. The most recent review, at the end of November 2021, gave the programme an amber/green rating.

I have two questions, which, in the interests of time, I will ask together. How is NRS managing risks, particularly around finance and resourcing, in the run-up to the census going live? What further review activity is anticipated over the remainder of the programme?

Yes, that is fine. You are happy with the process that you have in place.