Decision 067/2012 Mr Tom Gordon of the Sunday Herald and the Scottish Ministers

Internal audit reports relating to the Finance Directorate

Reference No: 201101544
Decision Date: 10 April 2012

Summary

Mr Tom Gordon of the Sunday Herald (Mr Gordon) asked the Scottish Ministers (the Ministers) for all of the information contained in 11 internal audit reports relating to their Finance Directorate, and its predecessor directorates.The Ministers responded by withholding all of the reports in their entirety in terms of section 30(c) of FOISA.Following a review, Mr Gordon remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Ministers had largely failed to deal with Mr Gordon's request for information in accordance with Part 1 of FOISA, by wrongly withholding the majority of the requested information in terms of section 30(c) of FOISA.However, she accepted that the exemption in section 30(c) had been correctly applied to certain information contained in two of the withheld reports.She required the Ministers to disclose the withheld reports, subject to the redaction of the exempt information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 30(c) (Prejudice to the effective conduct of public affairs)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

All references in this decision to "the Commissioner" are to Margaret Keyse, who has been appointed by the Scottish Parliamentary Corporate Body to discharge the functions of the Commissioner under section 42(8) of FOISA.

Background

1.Although this decision is concerned with a single information request, it is relevant to note at the outset that this was made alongside a number of others, and it has been considered together with these by the Ministers.

2.On 21 June 2011, Mr Gordon sent six emails to the Ministers.Each contained a separate information request seeking all information contained in one or more internal audit report(s), relating to the work of a particular Government Directorate, or the Cabinet Secretariat.The Commissioner understands that the titles and issue dates of these reports had been disclosed to Mr Gordon in response to a previous request for information.In total, Mr Gordon requested 81 internal audit reports.

3.In the request under consideration in this decision, Mr Gordon requested all items of information contained in 11 internal audit reports into the Finance Directorate and its predecessor directorates.A full list of these reports is provided in Appendix 2.

4.The Ministers responded to Mr Gordon's request on 19 July 2011, notifying Mr Gordon that they considered the requested information to be exempt from disclosure in terms of section 30(c) of FOISA.The exemption in section 30(c) applies to information, the disclosure of which would or, would be likely to, prejudice substantially the effective conduct of public affairs.The Ministers explained that they believed that disclosure of the requested information would lead to both staff and auditors being substantially inhibited in fulfilling their roles in the internal audit process.They maintained that this would undermine the effectiveness of internal auditing, which would substantially prejudice the effective conduct of public affairs.The other requests made by Mr Gordon on 21 July 2011 (seeking a further 70 internal audit reports) were all separately refused on the same grounds on or around the same date.

5.On 20 July 2011, Mr Gordon sent six emails to the Ministers separately requesting reviews of their decisions in relation to each of the information requests he made on 21 June 2011, asking the Ministers to rethink their decisions and release the information requested.In each request for review (including that concerning the request under consideration in this decision), Mr Gordon commented that it appeared from the arguments put forward in the Ministers' refusal notices that they were advancing a class argument; that the information he was requesting should be exempt because it is a certain type of information, regardless of its content.Mr Gordon argued that this was not a valid approach and noted that the Commissioner had ruled against class arguments on numerous occasions.

6.He also commented that there appeared to have been no serious attempt to sift the material he had requested to establish what information within it might be releasable, and which, if any, was truly exempt from disclosure under section 30(c), despite the claim that the public interest test had been applied.

7.Mr Gordon maintained that there was nothing sacrosanct about internal audit reports, and indicated that in recent weeks he had received internal audit reports from a number of other Scottish public authorities.He commented that the work of those authorities continued as before.He also highlighted a decision by the Commissioner[1] relating to the release of internal audit reports by VisitScotland.

8.The Ministers conducted a single review in relation to their handling of Mr Gordon's six requests for information, and notified Mr Gordon of the outcome of the review on 17 August 2011.The Ministers upheld their original decisions to withhold all of the information sought in each request under section 30(c) of FOISA.

9.On 18 August 2011, Mr Gordon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review in relation to the request set out in paragraph 3 above, and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Mr Gordon made separate applications for a decision in relation to his five other requests for internal audit reports, which are not under consideration in this decision.

10.The application was validated by establishing that Mr Gordon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

11.On 6 September 2011, the Ministers were notified in writing that an application had been received from Mr Gordon and were asked to provide the Commissioner with the information withheld from him (the 11 reports).The Ministers responded with the information requested and the case was then allocated to an investigating officer.

12.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.In particular, the Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.

13.In this letter (and in similar letters relating to the separate investigations concerning Mr Gordon's other requests for internal audit reports), the Ministers were advised to reconsider their application of the exemption in section 30(c) to all of the information requested by Mr Gordon.The investigating officer highlighted that the Commissioner has, on a number of occasions, required the disclosure of full or partial content of internal audit reports, and indicated that this approach was understood to be in line with practice elsewhere in the UK.

14.The investigating officer indicated that it was highly unlikely that the Commissioner would accept that internal audit reports should be treated as a class of information which is automatically exempt from disclosure simply on the basis that they are internal audit reports, and without any reference to the content and context of the reports.The investigating officer went on to suggest that it may therefore be appropriate for the Ministers to reconsider the content of the reports and to determine whether they could be disclosed to Mr Gordon, either in full or in part.

15.The Ministers responded to this letter, and the other five letters expressed in similar terms, with a single submission on 27 October 2011.The Ministers maintained that all information within the 81 reports sought by Mr Gordon's six information requests was exempt from disclosure in terms of section 30(c) of FOISA.They provided submissions explaining their reasoning when applying that exemption and the associated public interest test to the information in the 81 reports.

16.During the investigation, Mr Gordon was also asked for his submissions on the matters to be considered in this case.Since the Ministers adopted the same general arguments in relation to all information sought by his six requests for internal audit reports, Mr Gordon was invited to make a single response in relation to all six of his cases.This was received on 5 January 2012.

17.The relevant submissions received from both the Ministers and Mr Gordon will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

18.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Gordon and the Ministers and is satisfied that no matter of relevance has been overlooked.

19.Appendix 2 lists the reports that are under consideration in this decision.The numbering of the reports (56 ? 66), which is used to identify them where relevant in the discussion below, is drawn from the schedule of documents provided to the Commissioner by the Ministers.This numbered all of the reports covered by Mr Gordon's six requests in a single schedule.

Section 30(c) of FOISA ? Prejudice to the effective conduct of public affairs

20.Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs".The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b).This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by release of the information, and how that harm would (or would be likely to) be expected to follow from release.

21.Section 30(c) applies where the harm caused, or likely to be caused, by disclosure is at the level of substantial prejudice.There is no definition in FOISA of what is deemed to be substantial prejudice, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur and therefore needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

22.The Commissioner has previously stated that it is important for public authorities to treat each request for information on a case by case basis.Release of information in one case should not be taken to imply that information or communications of a particular type will be routinely released in future.The circumstances of each case, including the content of the specific information under consideration, must be taken into consideration and (where required) the public interest in each case assessed on its own merits.

Submissions from the Ministers

23.In their submissions, the Ministers noted that the withheld internal audit reports (including the 11 under consideration in this decision) were conducted within the Scottish Government Directorates on projects and processes to ensure effective and comprehensive conduct and to identify any learning points for better practice.They went on to state that the lessons learned from these reports are a tool for the Scottish Government to identify improvements required to their processes, and they are considered to be a valuable and vital part of the conduct of public affairs within the Scottish Government.The Ministers maintained that any potential reduction in the comprehensiveness of audit reports would constitute significant prejudice to the effective conduct of public affairs.

24.The Ministers submitted that it is essential for the effective conduct of an audit that staff feel free to provide all relevant information and views to the auditors freely and openly, and that the auditors' reports are able to record staff contributions and set their own conclusions and recommendations fully and frankly.The Ministers argued that, if these audit reports were to be released into the public domain, it is likely that both staff and auditors would be substantially inhibited in fulfilling their roles in the audit process.

25.The Ministers stated that they were not suggesting that these reports should be automatically withheld.However, they argued that if the reports (which may contain significant criticisms) were to be disclosed, there would be two main negative outcomes.Firstly, the co-operation of those whose work was being reviewed may be likely to be less free and frank in the future.Secondly, as these reports contain only part of the audit process, no consideration would be taken by the requester of the steps that have been taken to deal with issues raised in the reports and this would therefore be likely to lead to negative reporting without the benefit of the whole picture of the audit process.

26.The Ministers stated that the reports contain only a snapshot of the performance audited at a particular point in time.The Ministers noted that, since the reports were produced, progress will have been made in addressing any recommendations for improvements and, therefore, provision of the reports without this information would be likely to lead to unnecessarily negative reporting without awareness of remedial actions.

27.The Ministers acknowledged that (as had been argued by Mr Gordon), the internal audit reports should be considered on a case by case basis, with consideration given to each individual report to which exemptions may apply.However, the Ministers submitted that they did not want to create a situation whereby it is perceived that they only disclose favourable reports and that any audit reports that are withheld are presumed to be critical.The Ministers concluded that disclosure of the reports (including the 11 reports under consideration in this case) would undermine the effectiveness of internal audits within the Scottish Government substantially and would therefore substantially prejudice the effective conduct of public affairs.

Submissions from Mr Gordon

28.In his submissions, Mr Gordon noted that the Commissioner's guidance on the exemptions in section 30 of FOISA[2]states that:

"The exemptions under section 30 of FOISA should not be regarded as "class exemptions" under which information of a certain type (e.g. advice to Ministers) can be withheld without considering the content of the information.Requests for information should be assessed on an individual basis, and authorities should focus on the effect of releasing the specific information involved."

He commented that the Ministers appear to be attempting to create a class exemption for internal audit reports.He suggested that the Ministers "don't appear bothered with checking" the reports to see which parts would genuinely prejudice the conduct of public affairs if released, and expressed doubt that, if they had, they would have found that every word in every paragraph on every page in each of the 81 reports he has requested were capable of causing the harm claimed by Ministers.

29.Mr Gordon agreed that effective audits depend on staff talking freely with auditors, and auditors making frank conclusions and recommendations, but he did not accept that disclosure would substantially inhibit this as claimed by the Ministers.

30.He submitted that the Ministers were effectively impugning their own officials by suggesting they would withhold or distort information under audit because of FOISA.With respect to auditors, Mr Gordon recognised that their duties include an obligation to be frank and deliver sometimes unpalatable truths, but he expressed the view that the auditors will continue to fulfil these duties regardless of whether the reports they create are publicly disclosed or not.He added that what ultimately becomes of their reports should not affect their professional judgement or conduct.

31.Mr Gordon also responded to the Ministers' argument that disclosure of the internal audit reports would lead to "negative reporting".Mr Gordon argued that this appears to suggest that the Ministers had taken his employment into account when considering their response under FOISA, and it appeared to him that the Ministers are advocating two approaches to FOI requests, one for the general public and a more stringent approach for journalists.Mr Gordon argued that his profession is of no relevance and should have no bearing on how Ministers respond to a request under FOISA.He also noted that the Ministers were "perfectly capable" of explaining what remedial action has been taken in response to the audit reports, and that releasing the reports would not inhibit them from speaking up for themselves.

The Commissioner's view

32.The Commissioner has carefully considered the arguments made by the Ministers, when asking whether disclosure of the particular information requested by Mr Gordon would, or would be likely to, prejudice substantially the effective conduct of public affairs in the manner suggested by the Ministers.

33.She has also had regard to the opinion of the Court of Session in the case Scottish Ministers v Scottish Information Commissioner [2007] CSIH 8[3], in which the Court of Session considered arguments on behalf of the Ministers that the exemptions in sections 30(b) and (c) of FOISA would in some cases apply to classes of information (in that case, advice to Ministers), irrespective of the actual content of that information.The Ministers had maintained that the Commissioner had erred in law by concluding that these exemptions could only be applied after consideration of whether disclosure of the actual content of the information requested would, or would be likely to, lead to the effects specified in the exemptions.

34.Although the exemptions in section 30(b) are not under consideration in this case, the Commissioner considers that the Court's conclusions regarding these exemptions are also relevant when considering how the exemption in section 30(c) should be understood.The Court concluded (at paragraphs 14, 20 and 29):

"[14] [?] We are unable to find any error of law in the alternative approach which [the Commissioner] adopted, namely, (1) that each case was to be assessed on the facts and circumstances of that case and (2) that the proper approach was to assess whether the release of the advice or opinion contained within each document would be capable of having an inhibiting effect. That approach acknowledges and applies the principle that a piece of information viewed in context may qualify as being non-disclosable, albeit viewed in isolation it might have appeared to be innocuous. An approach to section 30 based on some a priori classification would appear to inhibit rather than to advance the requisite exercise.

?

[20] The criticisms made by the appellants in relation to the exemption under section 30(c) were essentially the same as those made in relation to that under section 30(b); the "class" argument is, in our view, ill-founded [?]

?

[29] [?] The respondent, rightly in our view, rejected the contention that the release of the information withheld in this case (revealing the advice and opinions of officials involved in the decision-making procedures) would as a generality inhibit officials in the future from providing a clear analysis of all the issues in a policy area. On the other hand, he held that certain documents, if released, would be likely to inhibit the exchange of similar advice and requests for advice in the future and restricted the order for release accordingly. We are unable to discover any error of law in that discriminating approach."

35.Bearing in mind these comments, the Commissioner considers that the exemption in section 30(c) can only be applied to the information requested by Mr Gordon if it is accepted that disclosure of the specific information would, or would be likely to, prejudice the effective conduct of public affairs.This is why she has decided not to make a single decision relating to Mr Gordon's six information requests, but instead to look at the information sought by Mr Gordon's requests on a case-by-case basis, and to assess the submissions received in relation to the actual information contained in each of the reports sought in each request.

36.In anticipation of this conclusion, and following an initial review of those 81 internal audit reports, the Ministers were given a clear indication of the likely outcome of this case if they continued to pursue the general arguments made in their responses to Mr Gordon's information request, and his subsequent request for review, and given strongly worded advice to re-consider their position.

37.The Commissioner is disappointed that the Ministers did not take that advice, but instead continued to rely on general arguments to explain why they considered all information contained in the 81 documents to be exempt in terms of section 30(c) of FOISA, without reference to the particular content of those reports.

38.The Commissioner's analysis of those arguments has nonetheless been made in relation to the specific information sought by the request under consideration in this decision.The information under consideration in this decision is that contained in 11 reports into the Finance Directorate and its predecessor directorates.

39.The Commissioner recognises that such reports are important and valuable tools that enable an organisation to evaluate its processes and policies in specific areas, highlighting both strengths and weaknesses, thereby enabling learning and improvement.It is clear that such processes contribute significantly to the effective conduct of public affairs.The Commissioner also acknowledges that, for an internal audit to be effective, staff and auditors must be able to communicate freely and frankly in order that the current policies and practice of the department being audited are openly and accurately described and that any recommendations that are made are full and relevant.It is the Commissioner's view that any disclosure that undermined the effectiveness of the Ministers' internal audit system would also be found to be likely to prejudice substantially the effective conduct of public affairs for the purposes of section 30(c).

40.Having considered the content of the withheld reports along with the submissions from the Ministers, the Commissioner is unable to accept in relation to the vast majority of the information therein that its disclosure would have that effect.However, having regard to the particular nature of the information in the reports, she has identified certain limited parts, in relation to which she accepts that disclosure would, or would be likely to, prejudice substantially the audit process or the processes of the wider business of the Scottish Government.She accepts that the exemption in section 30(c) was correctly applied to this information.

41.In what follows, the Commissioner has first explained her reasoning for concluding that the exemption in section 30(c) has been incorrectly applied to the majority of the withheld information, before explaining her conclusions with respect to the small amount of information she has found to be exempt under section 30(c).

42.The Ministers have argued that disclosure of any of the 81 internal audit reports requested by Mr Gordon (and so the 11 under consideration in this case) would result in staff and auditors being substantially inhibited in future audits, that staff would be less frank and open with their views, and that auditors themselves may also feel inhibited from properly fulfilling their role in the audit process.

43.Having considered the contents of the reports under consideration, the Commissioner cannot accept that such inhibition, either for staff or auditors, would be likely to follow from disclosure of all of the information under consideration.

44.The Commissioner notes that each of the reports are set out in a standardised form, with the methodology, findings and outcome of the audit expressed in professional and dispassionate terms.As with any internal audit, practice in the relevant area is assessed, and areas in which improvement can be made are identified.

45.In the absence of submissions highlighting particular concerns relating to the information under consideration, the Commissioner can see nothing in the vast majority of the information within the reports which would be likely to prompt either auditors or officials engaging with the audit process to be less open or frank in future internal audits.She can also find nothing within it which would, in her view, prevent or substantially inhibit staff or auditors from fulfilling their roles in any future internal audit.

46.The Commissioner notes that the staff undertaking roles within the audit process are professionals, who can be expected to undertake their functions with integrity and diligence.She does not accept that disclosure of reports of the nature under consideration in this case would be likely to make them feel unable to do so in future cases.

47.She also considers that it will be understood by all staff involved in the process that an audit is necessarily designed to be a critical process, in which weaknesses in procedures and practice will be identified and discussed, for the clear purpose of achieving organisational improvement.

48.Since the Ministers' submissions have been made in very general terms, with no reference to the content of the particular reports under consideration, the Commissioner can only conclude that they have not provided any evidence to explain or suggest why the disclosure of this information would be likely to lead to such harm.

49.The Ministers have also argued that the audit reports contain only a snapshot of a performance audited at a particular time, and that it is unlikely that the requester (Mr Gordon) would take any note of the steps that have since been taken to deal with the issues raised in the reports.The Ministers have argued that this would lead to unnecessarily negative reporting, without any awareness of remedial action, implying that such an outcome would prejudice substantially the effective conduct of public affairs.

50.The Commissioner acknowledges that "bad press", especially if founded on a half-story or a percentage of the facts, would not be beneficial to the Ministers, but she does not agree that this would necessarily, even if such reporting were likely to follow from the disclosure of particular information, be likely to prejudice substantially the effective conduct of public affairs.The Commissioner notes that the Ministers are free and able to proactively publish whatever information they consider relevant and/or appropriate regarding the reports, or steps taken since their issue, should they consider that their disclosure in isolation would lead to only a partial understanding of the facts.

51.Even so, she considers that it would be clear to any person reading the reports that changes are very likely to have been made in relation to areas of weakness identified in the reports in the period since their completion.This is because the reports generally include an action plan in response to the recommendations, and at least a year had passed between the finalisation of each report and the time when the Ministers had notified Mr Gordon of the outcome of their review.The Commissioner considers it unlikely that any person working in the established press would report the contents of these reports as if they described the continuing state of affairs, since doing so would be based on a misunderstanding of the content of the reports and the nature of the process described.

52.The question of whether substantial prejudice to the effective conduct of public affairs would or would be likely to follow from disclosure must of course be answered in relation to the specific content of the reports under consideration.In this particular case, the Commissioner can see no reason (and has been given no explanation as to) why the Ministers should anticipate that reporting of the content of these reports in the media would be so unduly negative, or so inaccurately represent the practice of the Ministers, so as to be likely to cause such prejudice.

53.It is the Commissioner's view that if the Ministers nonetheless remain concerned that the publicity generated by disclosure of these reports would be overly negative ? and unfairly so as it would not provide details of any remedial action that might have been taken in response to any negative findings of the reports ? they could easily publish information showing what steps have been taken since the requested reports were published.Such an approach would seem, to the Commissioner, to be a sensible way of managing the risk of anticipated "bad press".

54.The Ministers have also argued that (although they accept that they should consider all information on a case by case basis) if they considered each audit report on a case by case basis (as suggested by Mr Gordon and the Commissioner) they could create a situation whereby requesters who seek such information draw conclusions based on whether the report they seek is withheld or not (e.g. favourable audit reports are routinely disclosed whereby critical ones are withheld).

55.This point appears to be based on an assumption that decisions to disclose or withhold information (presumably given the application or not of section 30(c) of FOISA) would be based on a simple assessment of whether a report was "critical" of the practice assessed or not.The Commissioner has been given no submission to explain why an assessment of the actual content of the reports sought by Mr Gordon and the likely effects of disclosure would lead to that outcome.No explanation has been given as to why the disclosure of "critical" reports or content would, or would be likely to, prejudice substantially the effective conduct of public affairs, or what degree of criticism would trigger that prejudice.Instead, the Ministers appear to have taken an extremely precautionary approach of withholding all content of all internal audit reports, apparently to avoid having to identify (by withholding it) which information or which reports they consider to be critical, or otherwise harmful to disclose.Despite the Ministers' claim that they are not suggesting that these reports should automatically be withheld, the effect of their approach appears to the Commissioner to be just that.

56.Given the content-based approach to the consideration of section 30(c) of FOISA that is advocated in previous decisions, and has been endorsed by the Court of Session, the Commissioner is simply unable to accept this argument.

57.Firstly, the Commissioner would note that information that has been requested under FOISA should be disclosed to the requester unless it falls under an exemption provided for in Part 2 of the Act.The Commissioner would also note that, where a requester has asked for the information contained in a specific report or document, the authority should not routinely withhold the entire report because it considers that some of the report is exempt from disclosure under Part 2 of FOISA.The Commissioner would expect an authority to consider all information within that report to see if the information contained within it should be disclosed or withheld.The Commissioner would also expect authorities to consider which exemption is most appropriate and apply relevant exemptions to each piece of information it is seeking to withhold.

58.The Ministers' argument seems to be suggesting that entire reports would either be wholly exempt from disclosure or freely released.The Commissioner would note that information rarely falls into such simple categories.She acknowledges that requesters may form opinions on information that is withheld if other information is routinely disclosed, but that, in itself, is no reason to withhold an entire series of reports.The Commissioner is unwilling to withhold information in this case simply because its disclosure may lead to speculation regarding information that may be withheld in another case.The Commissioner must consider each case on its own merits.

59.Having considered all of the (limited) arguments put forward by the Ministers, the Commissioner is for the most part unable to accept that the exemption in section 30(c) of FOISA applies to the information contained in the reports that are under consideration in this decision.

60.However, as noted above, the Commissioner has concluded that certain information is exempt under section 30(c).This is

Report 59, Annex 2 ? names and card numbers

Report 65, Section 4.4, points 3 to 7

Report 59 ? names and card numbers

61.Report 59 relates to an audit of the Government Procurement Card (GPC) management and monitoring arrangements in 2009/10.Annex 2 of this report records the names of certain staff who hold Government Procurement Cards and certain of the digits on these cards that make up the account number.

62.The Commissioner accepts that disclosure of this information could inhibit the audit process by prompting auditors to avoid presenting full details of such cases in which weaknesses had been identified to avoid giving rise to the risk of fraudulent activity (given the disclosure of credit card details) or of suggesting impropriety on the part of specific individuals (via the disclosure of the names of staff card holders).Naming the individuals in this context could also lead to staff members being less willing to engage fully with the audit process, for fear that they would be publicly identified in such a context in future.

63.The Commissioner is satisfied that the disclosure of this particular information would be likely to prejudice substantially the effective conduct of public affairs, with respect to the Ministers' internal audit processes.

64.Although the Ministers did not raise security concerns within their submissions regarding section 30(c) of FOISA, the Commissioner also considers that disclosure of details of credit cards could have led to prejudice to the effective conduct of public affairs with respect to the management of the Government finances, by increasing the risk of fraudulent activity.

65.The Commissioner is therefore satisfied that the Ministers were entitled to apply the exemption in section 30(c) to the names and card numbers contained in Annex 2 of this report.

Report 65 ? points 3 to 7 in section 4.4

66.Report 65 relates to an audit of the Government's Facilities and Estates Services (part of the HR and Corporate Services Directorate) in relation to its property and facilities management: house teams and projects.Within section 4.4, points 3 to 7 concern information relating to security arrangements that were in place at the time of the audit. Whilst it is clear from the report that actions should have been taken to address the issues noted, the Commissioner has received no evidence to demonstrate that this has in fact happened.

67.The Commissioner considers that the sensitivity of the information is such that if it were to be released, then it would have the effect of inhibiting the reporting of future audits, prompting auditors to less fully identify the issues identified for fear of highlighting security arrangements and thereby impacting on the Ministers' ability to maintain security of premises.

68.The Commissioner is satisfied that disclosure of this particular information would or would be likely to prejudice substantially the effective conduct of public affairs in relation to the internal audit process, and that the Ministers were entitled to apply the exemption in section 30(c) to the information from points 3 to 7 in section 4.4 of report 65.

Consideration of the public interest test

69.As noted above, the exemption in section 30(c) is subject to the public interest test in section 2(1)(b), and so the Commissioner must now consider whether, in all the circumstances of the case, the public interest in disclosing the information found to be exempt is outweighed by that in maintaining the exemption.It is only if this is the case that the Commissioner can require the Ministers to disclose this information.

70.In their submissions on the public interest, the Ministers considered that there was some public interest in disclosure of the withheld information in the interests of open and transparent government. However, they considered there to be a greater public interest in ensuring that candid and comprehensive audit reports are always produced, to enable staff to identify and learn lessons from them, and continue to develop and improve processes.On balance, the Ministers concluded that the public interest lay in favour of upholding the exemption in section 30(c).

71.In his submissions on the public interest test, Mr Gordon considered that the internal audit process is an integral part of the way that public bodies conduct their business and this highlights good practice as well as bad.Disclosure would, in Mr Gordon's view, ultimately lead to more efficient government and greater transparency and understanding.

72.Mr Gordon went on to comment further that covering up problems is unhealthy and detrimental to government and the public realm.It is in the public interest, in Mr Gordon's view, for that process to be understood and for problems that have been identified to have been remedied.

73.Mr Gordon submitted that a greater public understanding of this process, which would include public gratitude for remedying problems, is not a substantial threat to the conduct of public affairs, as the Ministers have argued.Mr Gordon expressed the belief that a genuine threat to the conduct of public affairs is a failure to learn from past mistakes and attempting to muddle through in secret, which he considered perpetuates and exacerbates weaknesses in the system.

74.All of the submissions made by both the Ministers and Mr Gordon have been fully considered by the Commissioner in coming to a decision on where the balance of the public interest lies.

75.As noted above, the Commissioner recognises that the internal audit process is an important part of assessing compliance with controls, processes and procedures and ensuring the effective operation of all directorates within the Scottish Government.The Commissioner accepts that disclosure of the reports that follow on from these internal audits would go a considerable way to informing the public of the effectiveness of the Scottish Government, and would facilitate a greater understanding of how the Scottish Government and its internal audit process operates.

76.However, balanced against this, the Commissioner recognises that there is a public interest in ensuring that the comprehensiveness of the internal audit process is not undermined, and that the individuals conducting the audit and staff in the area being audited remain able to be frank and open about the matters under consideration, and when reporting findings and recommendations.

77.As the Commissioner has found that the Ministers were wrong to withhold the majority of the information contained within the reports, she considers that the public interest in understanding the audit process, will be met to a significant degree by the disclosure of that information in response to this decision, and would have been met had the Ministers decided to do so following their internal review.

78.The Commissioner does not consider that disclosure of the information she has found to be exempt within report 59 would contribute significantly further to the public's understanding of the issues addressed in that report or the audit process more generally.The matters raised, and the auditor's comments thereon, are still entirely understandable without access to the specific details of the cards and card-holders concerned.The Commissioner therefore considers that the public interest in disclosure of that information is very limited, and must be weighed against the public interest in maintaining the exemption to ensure that auditors retain their ability to carry out and report thorough and comprehensive audits.

79.The information the Commissioner has found to be exempt in report 65 is of greater substance, and would both contribute to a fuller understanding of the information security measures adopted by the Ministers and demonstrate the thoroughness of the internal audit process in addressing these.

80.The Commissioner considers that there is some weight to Mr Gordon's public interest arguments when considered in relation to this information.However, she also considers that there is a significant public interest in ensuring that the information regarding the security measures adopted by the Ministers are not undermined by disclosure.Given her conclusions regarding the likelihood that disclosure would inhibit future internal audits, she also considers that there is weight to the public interest in maintaining the exemption to avoid harm to the effectiveness of the internal audit process within the Scottish Government.

81.On balance, having considered the information contained in reports 59 and 65 that she has found to be exempt under section 30(c), and the submissions from both the Ministers and Mr Gordon, the Commissioner finds that the public interest in disclosing that information is outweighed by maintaining the exemption in section 30(c) of FOISA.She has therefore concluded that the Ministers were entitled to withhold this information under section 30(c) of FOISA.

82.With respect to the remaining information which has not been found to be exempt from disclosure, the Commissioner now requires this to be disclosed to Mr Gordon.As will be clear from the discussion above, the Commissioner is disappointed that the Ministers continued to adopt their class based approach to the consideration of the 11 reports considered in this decision.

83.This approach appears to be contrary not only to decisions from the Commissioner and the Court of Session, but also the Scottish Government's own internal guidance on handling requests for information under FOISA[4].On page 20, this guidance provides specific advice on handling requests for internal audit reports. It states:

"There is no specific exemption in FOISA for internal audit reports??This means any requests for such a report must be considered on a case by case basis and the application of any FOISA exemption(s) must be based on the actual content of the particular report requested."

The guidance goes on to highlight (quite appropriately) certain exemptions which might be found to be applicable to particular types of content, where it is present within an internal audit report.

84.The Commissioner has been surprised to note that the Ministers' approach in this instance differs so markedly from their own internal (and published) guidance, and she would recommend that, when considering future requests for information contained in internal audit reports, the advice given in this document is followed.

DECISION

The Commissioner finds that the Scottish Ministers generally failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Gordon.

The Commissioner finds that by withholding the following information under section 30(c) of FOISA, the Ministers complied with Part 1:

Report 59, Annex 2 ? names and card numbers

Report 65, section 4.4 ? points 3 to 7

However, the Ministers failed to comply with Part 1 and in particular section 1(1) by withholding the remaining information contained in the 11 internal audit reports under section 30(c) of FOISA.

The Commissioner therefore requires the Ministers to disclose all of the information in reports 56 to66, subject to the redaction of the information specified above by 25 May 2012.

Appeal

Should either Mr Gordon or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Acting Scottish Information Commissioner
10 April 2012

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

?

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

?

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

[1] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2010/200900988.aspx

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section30/Section30.aspx

[3] http://www.scotcourts.gov.uk/opinions/2007CSIH08.html

[4] http://www.scotland.gov.uk/Resource/Doc/933/0113676.pdf

Appendix 2 can be viewed in the pdf version of this decision