Decision 076/2012 | Scottish Information Commissioner

Home Decisions

Decision 076/2012

Decision 076/2012 Mr Tom Gordon of the Sunday Herald and the Scottish Ministers

Internal audit reports relating to the Governance and Communities Directorate

Reference No: 201101540
Decision Date: 24 April 2012

Summary

Mr Tom Gordon of the Sunday Herald (Mr Gordon) asked the Scottish Ministers (the Ministers) for all of the information contained in 20 internal audit reports relating to their Governance and Communities Directorate and its predecessor directorates.The Ministers responded by withholding all of the reports in their entirety in terms of section 30(c) of the Freedom of Information (Scotland) Act 2002 (FOISA).Following a review, Mr Gordon remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Ministers had largely failed to deal with Mr Gordon's request for information in accordance with Part 1 of FOISA, by wrongly withholding the majority of the requested information in terms of section 30(c) of FOISA.However, she accepted that the exemption in section 30(c) had been correctly applied to certain information contained in two of the withheld reports.She required the Ministers to disclose the withheld reports, subject to the redaction of the exempt information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 30(c) (Prejudice to the effective conduct of public affairs)

The full text of each of the statutory provisions cited above is reproduced in the Appendix 1 to this decision. Appendix 1 forms part of this decision.

All references in this decision to "the Commissioner" are to Margaret Keyse, who has been appointed by the Scottish Parliamentary Corporate Body to discharge the functions of the Commissioner under section 42(8) of FOISA.

Background

1.Although this decision is concerned with a single information request, it is relevant to note at the outset that this was made alongside a number of others, and it has been considered together with these by the Ministers.

2.On 21 June 2011, Mr Gordon sent six emails to the Ministers.Each contained a separate information request seeking all information contained in one or more internal audit report(s), relating to the work of a particular Government Directorate, or the Cabinet Secretariat.The Commissioner understands that the titles and issue dates of these reports had been disclosed to Mr Gordon in response to a previous request for information.In total, Mr Gordon requested 81 internal audit reports.

3.In the request under consideration in this decision, Mr Gordon requested all items of information contained in 20 internal audit reports into the Governance and Communities Directorate and its predecessor directorates.A full list of these reports is provided in Appendix 2.(Appendix 2 forms part of this decision.)

4.The Ministers responded to Mr Gordon's request on 19 July 2011, notifying Mr Gordon that they considered the requested information to be exempt from disclosure in terms of section 30(c) of FOISA.The exemption in section 30(c) applies to information when its disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs.The Ministers explained that they believed that disclosure of the requested information would lead to both staff and auditors being substantially inhibited in fulfilling their roles in the internal audit process.They maintained that this would undermine the effectiveness of internal auditing, which would substantially prejudice the effective conduct of public affairs.The other requests made by Mr Gordon on 21 June 2011 (seeking a further 61 internal audit reports) were all separately refused on the same grounds on or around the same date.

5.On 20 July 2011, Mr Gordon sent six emails to the Ministers separately requesting reviews of their decisions in relation to each of the information requests he made on 21 June, asking the Ministers to rethink their decisions and release the information requested.In each request for review (including that concerning the request under consideration in this decision), Mr Gordon commented that it appeared from the arguments put forward in the Ministers' refusal notices that they were advancing a class argument; that the information he was requesting should be exempt because it is a certain type of information, regardless of its content.Mr Gordon argued that this was not a valid approach and noted that the Commissioner had ruled against class arguments on numerous occasions.

6.He also commented that there appeared to have been no serious attempt to sift the material he had requested to establish what information within it might be releasable, and which, if any, was truly exempt from disclosure under section 30(c), despite the claim that the public interest test has been applied.

7.Mr Gordon maintained that there was nothing sacrosanct about internal audit reports, and indicated that in recent weeks he had received internal audit reports from a number of Scottish public authorities.He commented that the work of those authorities continued as before. He also highlighted a decision by the Commissioner[1] relating to the release of internal audit reports by VisitScotland.

8.The Ministers conducted a single review in relation to their handling of Mr Gordon's six requests for information, and notified Mr Gordon of the outcome of the review of 17 August 2011.The Ministers upheld their original decisions to withhold all of the information sought in each request under section 30(c) of FOISA.

9.On 18 August 2011, Mr Gordon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review in relation to the request set out in paragraph 3 above, and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Mr Gordon made separate applications for a decision in relation to his five other requests for internal audit reports, which are not under consideration in this decision.

10.The application was validated by establishing that Mr Gordon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

11.On 6 September 2011, the Ministers were notified in writing that an application had been received from Mr Gordon and were asked to provide the Commissioner with the information withheld from him (the 20 reports).The Ministers responded with the information requested and the case was then allocated to an investigating officer.

12.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. In particular, the Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.

13.In this letter (and in similar letters relating to the separate investigations concerning Mr Gordon's other requests for internal audit reports), the Ministers were advised to reconsider their application of the exemption in section 30(c) to all of the information requested by Mr Gordon.The investigating officer highlighted that the Commissioner has, on a number of occasions, required the disclosure of full or partial content of internal audit reports, and indicated that this approach was understood to be in line with practice elsewhere in the UK.

14.The investigating officer indicated that it was highly unlikely that the Commissioner would accept that internal audit reports should be treated as a class of information that is automatically exempt from disclosure simply on the basis that they are internal audit reports, and without any reference to the content and context of the report.The investigating officer went on to suggest that it may therefore be appropriate for the Ministers to reconsider the content of the report and determine whether they could be disclosed to Mr Gordon, either in full or in part.

15.The Ministers responded to this letter, and the other five letters expressed in similar terms, with a single submission on 27 October 2011.The Ministers maintained that all information within the 81 reports sought by Mr Gordon's six information requests was exempt from disclosure in terms of section 30(c) of FOISA.They provided submissions explaining their reasoning when applying that exemption and the associated public interest test, to the information in the reports.

16.During the investigation, Mr Gordon was also asked for his submissions on the matters to be considered in this case.Since the Ministers adopted the same general arguments in relation to all of the information sought by his six requests for internal audit reports, Mr Gordon was invited to make a single response in relation to all six cases.This was received on 5 January 2012.

17.The relevant submissions received from both the Ministers and Mr Gordon will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

18.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Gordon and the Ministers and is satisfied that no matter of relevance has been overlooked.

19.Appendix 2 lists the reports that are under consideration in this decision.The numbering of the reports (2 - 21), which is used to identify them where relevant in the discussion below, is drawn from the schedule of documents provided to the Commissioner by the Ministers.This numbered all of the reports covered by Mr Gordon's six requests in a single schedule.

Section 30(c) of FOISA ? Prejudice to the effective conduct of public affairs

20.Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs".The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b).This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would be caused to the conduct of public affairs by release of the information, and how that harm would be expected to follow from release.

21.Section 30(c) applies where the harm caused, or likely to be caused, by disclosure is at the level of substantial prejudice.There is no definition in FOISA of what is deemed to be substantial prejudice, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur and therefore needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

22.The Commissioner has previously stated that it is important for public authorities to treat each request for information on a case by case basis.Release of information in one case should not be taken to imply that information or communications of a particular type will be routinely released in future.The circumstances of each case, including the content of the specific information under consideration, must be taken into consideration and (where required) the public interest in each case assessed on its own merits.

Submissions from the Ministers

23.In their submissions, the Ministers noted that the withheld internal audit reports (including the 20 under consideration in this decision) were conducted within the Scottish Government Directorates on projects and processes to ensure effective and comprehensive conduct and to identify any learning points for better practice.They went on to state that the lessons learned from these reports are a tool for the Scottish Government to identify improvements required to their processes, and they are considered to be a valuable and vital part of the conduct of public affairs within the Scottish Government.The Ministers maintained that any potential reduction in the comprehensiveness of audit reports would constitute significant prejudice to the effective conduct of public affairs.

24.The Ministers submitted that it is essential for the effective conduct of an audit that staff feel free to provide all relevant information and views to the auditors freely and openly, and that the auditors' reports are able to record staff contributions and set their own conclusions and recommendations fully and frankly.The Ministers argued that, if these audit reports were to be released into the public domain, it is likely that both staff and auditors would be substantially inhibited in fulfilling their roles in the audit process.

25.The Ministers stated that they were not suggesting that these reports should be automatically withheld.However, they argued that if the reports (which may contain significant criticisms) were to be disclosed, there would be two main negative outcomes.Firstly, the co-operation of those whose work was being reviewed may be likely to be less free and frank in the future.Secondly, as these reports contain only part of the audit process, no consideration would be taken by the requester of the steps that have been taken to deal with issues raised in the reports, and this would therefore be likely to lead to negative reporting without the benefit of the whole picture of the audit process.

26.The Ministers stated that the reports contain only a snapshot of the performance audited at a particular point in time.The Ministers noted that since the reports were produced progress will have been made in addressing any recommendations for improvements, and therefore, provision of the reports without this information would be likely to lead to unnecessarily negative reporting without awareness of the remedial actions.

27.The Ministers acknowledged that (as has been argued by Mr Gordon) the internal audit reports should be considered on a case by case basis, with consideration given to each individual report to which exemptions may apply.However, the Ministers submitted that they did not want to create a situation whereby it is perceived that they only disclose favourable reports and that any audit reports that are withheld are presumed to be critical.The Ministers concluded that disclosure of the reports (including the 20 reports under consideration in this case) would undermine the effectiveness of internal audits within the Scottish Government substantially and would therefore substantially prejudice the effective conduct of public affairs.

Submissions from Mr Gordon

28.In his submissions, Mr Gordon noted that the Commissioner's guidance on the exemptions in section 30 of FOISA[2] states that:

"The exemptions under section 30 of FOISA should not be regarded as "class exemptions" under which information of a certain type (e.g. advice to Ministers) can be withheld without considering the content of the information.Requests for information should be assessed on an individual basis and authorities should focus on the effect of releasing the specific information involved."

He commented that the Ministers appear to be attempting to create a class exemption for internal audit reports.He suggested that the Ministers "don't appear bothered with checking" the reports to see which parts would genuinely prejudice the conduct of public affairs if released, and expressed doubt that, if they had, they would have found out that every word in every paragraph on every page in each of the 81 reports he has requested were capable of causing the harm claimed by Ministers.

29.Mr Gordon agreed that effective audits depend on staff talking freely with auditors and auditors making frank conclusions and recommendations, but he did not accept that disclosure would substantially inhibit this as claimed by the Ministers.

30.He submitted that the Ministers were effectively impugning their own officials by suggesting that they would withhold or distort information under audit because of FOISA.With respect to auditors, Mr Gordon recognised that their duties include an obligation to be frank and deliver sometimes unpalatable truths, but expressed the view that the auditors will continue to fulfil these duties regardless of whether the reports they create are publicly disclosed or not.He added that what ultimately becomes of their reports should not affect their professional judgement or conduct.

31.Mr Gordon also responded to the Ministers' argument that disclosure of the internal audit reports would lead to 'negative reporting'.Mr Gordon has argued that this appears to suggest that the Ministers had taken his employment into account when considering their response under FOISA, and it appeared to him that the Ministers are advocating two approaches to FOI requests, one for the general public and a more stringent approach for journalists.Mr Gordon argued that his profession is of no relevance and should have no bearing on how Ministers respond to a request under FOISA.He also noted that the Ministers were perfectly capable of explaining what remedial action has been taken in response to the audit reports, and that releasing the reports would not inhibit them from speaking up for themselves.

The Commissioner's view

32.The Commissioner has carefully considered the arguments made by the Ministers, when asking whether disclosure of the particular information requested by Mr Gordon would, or would be likely to, prejudice substantially the effective conduct of public affairs in the manner suggested by Ministers.

33.She has also had regard to the opinion of the Court of Session in the case of Scottish Ministers v Scottish Information Commissioner [2007] CSIH 8[3], in which the Court of Session considered arguments on behalf of the Ministers that the exemptions in section 30(b) and (c) of FOISA would in some cases apply to classes of information.The Ministers had maintained that the Commissioner had erred in law by concluding that these exemptions could only be applied after consideration of whether disclosure of the actual content of the information requested would, or would be likely to, lead to the effects specified in the exemptions.

34.Although the exemptions in section 30(b) are not under consideration in this case, the Commissioner considers that the Court's conclusions regarding these exemptions are also relevant when considering how the exemption in section 30(c) should be understood.The Court concluded (at paragraphs 14, 20 and 29):

"[14] [?] We are unable to find any error of law in the alternative approach which [the Commissioner] adopted, namely, (1) that each case was to be assessed on the facts and circumstances of that case and (2) that the proper approach was to assess whether the release of the advice or opinion contained within each document would be capable of having an inhibiting effect. That approach acknowledges and applies the principle that a piece of information viewed in context may qualify as being non-disclosable, albeit viewed in isolation it might have appeared to be innocuous. An approach to section 30 based on some a priori classification would appear to inhibit rather than to advance the requisite exercise.

[20] The criticisms made by the appellants in relation to the exemption under section 30(c) were essentially the same as those made in relation to that under section 30(b); the "class" argument is, in our view, ill-founded [?]

[29] [?] The respondent, rightly in our view, rejected the contention that the release of the information withheld in this case (revealing the advice and opinions of officials involved in the decision-making procedures) would as a generality inhibit officials in the future from providing a clear analysis of all the issues in a policy area. On the other hand, he held that certain documents, if released, would be likely to inhibit the exchange of similar advice and requests for advice in the future and restricted the order for release accordingly. We are unable to discover any error of law in that discriminating approach."

35.Bearing in mind these comments, the Commissioner considers that the exemption in section 30(c) can only be applied to the information requested by Mr Gordon if it is accepted that disclosure of the specific information would, or would be likely to, prejudice the effective conduct of public affairs.This is why she has decided not to make a single decision relating to Mr Gordon's six information requests, but instead to look at the information sought by Mr Gordon's requests on a case-by-case basis, and to assess the submissions received in relation to the actual information contained in each of the reports sought in each request.

36.In anticipation of this conclusion, and following an initial review of those 81 internal audit reports, the Ministers were given a clear indication of the likely outcome of this case if they continued to pursue the general arguments made in their responses to Mr Gordon's information request, and his subsequent request for review, and given strongly worded advice to re-consider their position.

37.The Commissioner is disappointed that the Ministers did not take that advice, but instead continued to rely on general arguments to explain why they considered all information contained in the 81 documents to be exempt in terms of section 30(c) of FOISA, without reference to the particular content of those reports.

38.The Commissioner's analysis of those arguments has nonetheless been made in relation to the specific information sought by the request under consideration in this decision.The information under consideration in this decision is that contained in 20 reports into the Governance and Communities Directorate and its predecessor directorates.

39.The Commissioner recognises that such reports are important and valuable tools that enable an organisation to evaluate its processes and policies in specific areas, highlighting both strengths and weaknesses, thereby enabling learning and improvement.It is clear that such processes contribute significantly to the effective conduct of public affairs.The Commissioner also acknowledges that, for an internal audit to be effective, staff and auditors must be able to communicate freely and frankly in order that the current policies and practice of the department being audited are openly and accurately described and that any recommendations that are made are full and relevant.It is the Commissioner's view that any disclosure that undermined the effectiveness of the Ministers' internal audit system would also be found to be likely to prejudice substantially the effective conduct of public affairs for the purposes of section 30(c).

40.Having considered the content of the withheld reports, along with the submissions from the Ministers, the Commissioner is unable to accept in relation to the vast majority of the information therein that its disclosure would have that effect.However, having regard to the particular nature of the information in the reports, she has identified certain limited parts, in relation to which she accepts that disclosure would undermine the audit process or the processes or the wider business of the Scottish Government.She accepts that the exemption in section 30(c) was correctly applied to this information.

41.In what follows, the Commissioner has first explained her reasoning for concluding that the exemption in section 30(c) has been incorrectly applied to the majority of the withheld information, before explaining her conclusions with respect to the small amount of information she has found to be exempt under section 30(c).

42.The Ministers have argued that disclosure of any of the 81 internal audit reports requested by Mr Gordon (and so the 20 under consideration in this case) would result in staff and auditors being substantially inhibited in future audits, that staff would be less frank and open with their views and that auditors themselves may also feel inhibited from properly fulfilling their role in the audit process.

43.Having considered the contents of the reports under consideration, the Commissioner cannot accept that such inhibition, either for staff or auditors, would be likely to follow from disclosure of all of the information under consideration.

44.The Commissioner notes that each of the reports are set out in a standardised form, with the methodology, findings and outcome of the audit expressed in professional and dispassionate terms.As with any internal audit, practice in the relevant area is assessed, and areas in which improvement can be made are identified.

45.In the absence of submissions highlighting particular concerns relating to the information under consideration, the Commissioner can see nothing in the vast majority of the information within the reports which would be likely to prompt either auditors or officials engaging with the audit process to be less open or frank in future internal audits.She can also find nothing within it which would, in her view, prevent or substantially inhibit staff or auditors from fulfilling their roles in any future internal audit.

46.The Commissioner notes that the staff undertaking roles within the audit process are professionals, who can be expected to undertake their functions with integrity and diligence.She does not accept that disclosure of reports of the nature under consideration in this case would be likely to make them feel unable to do so in future cases.

47.She also considers that it will be understood by all staff involved in the process that an audit is necessarily designed to be a critical process, in which weaknesses in procedures and practice will be identified and discussed, for the clear purpose of achieving organisational improvement.

48.Since the Ministers' submissions have been made in very general terms, with no reference to the content of these particular reports under consideration, the Commissioner can only conclude that they have not provided any evidence to explain or suggest why the disclosure of this information would be likely to lead to such harm.

49.The Ministers have also argued that the audit reports contain only a snapshot of a performance audited at a particular time, and that it is unlikely that the requester (Mr Gordon) would take any note of the steps that have since been taken to deal with the issues raised in the reports.The Ministers have argued that this would lead to unnecessarily negative reporting without any awareness of remedial action, implying that such an outcome would prejudice substantially the effective conduct of public affairs.

50.The Commissioner acknowledges that 'bad press', especially if founded on a half-story or a percentage of the facts, would not be beneficial to the Ministers.However, she does not agree that this would necessarily, even if such reporting were likely to follow from the disclosure of particular information, be likely to prejudice substantially the effective conduct of public affairs.The Commissioner notes that the Ministers are free and able to proactively publish whatever information they consider relevant and/or appropriate regarding the reports, or steps taken since their issue, should they consider that their disclosure in isolation would lead to only a partial understanding of the facts.

51.Even so, she considers that it would be clear to any person reading the reports that changes are very likely to have been made in relation to areas of weakness identified in the reports in the period since their completion.This is because the reports generally include an action plan in response to their recommendations, and, in the case of the majority of the reports, at least a year had passed between the finalisation of each report and the time when the Ministers had notified Mr Gordon of the outcome of their review.The Commissioner considers it unlikely that any person working in the established press would report the content of these reports as if they described the continuing state of affairs, since doing so would be based on a gross misunderstanding of the content of the reports and the nature of the process described therein.

52.The question of whether substantial prejudice to the effective conduct of public affairs would, or would be likely to, follow from disclosure must of course be answered in relation to the specific content of the reports under consideration.In this particular case, the Commissioner can see no reason (and has been given no explanation as to) why the Ministers should anticipate that reporting the content of these reports in the media would be so unduly negative, or so inaccurately represent the practice of Ministers, so as to be likely to cause such prejudice.

53.It is the Commissioner's view that if the Ministers nonetheless remain concerned that the publicity generated by disclosure of these reports would be overly negative ? and unfairly so as it would not provide details of any remedial action that might have been taken in response to any negative findings of the reports ? they could easily publish information showing what steps have been taken since the requested reports were completed.Such an approach would seem to the Commissioner, to be a sensible way of managing the risk of anticipated 'bad press'.

54.The Ministers have also argued that (although they accept that they should consider all information on a case by case basis) if they considered each audit report on a case by case basis (as suggested by Mr Gordon and the Commissioner) they could create a situation whereby requesters who seek such information draw conclusions based on whether the report they seek is withheld or not (e.g. favourable audit reports are routinely disclosed whereby critical ones are withheld).

55.This point appears to be based on an assumption that decisions to disclose or withhold information (presumably given the application or not of section 30(c) of FOISA) would be based on a simple assessment of whether a report was "critical" of the practice assessed or not.The Commissioner has been given no submission to explain why an assessment of the actual content of the reports sought by Mr Gordon and the likely effects of disclosure would lead to that outcome.No explanation has been given as to why the disclosure of "critical" reports or content would, or would be likely to, prejudice substantially the effective conduct of public affairs, or what degree of criticism would trigger that prejudice.Instead, the Ministers appear to have taken an extremely precautionary approach of withholding all content of all internal audit reports, apparently to avoid having to identify (by withholding it) which information or which reports they consider to be critical, or otherwise harmful to disclose.Despite the Ministers' claim that they are not suggesting that these reports should automatically be withheld, the effect of their approach appears to the Commissioner to be just that.

56.Given the content-based approach to the consideration of section 30(c) of FOISA which is advocated in previous decisions, and has been endorsed by the Court of Session, the Commissioner is simply unable to accept this argument.

57.Firstly, the Commissioner would note that information that has been requested under FOISA should be disclosed to the requester unless it falls under an exemption provided for in Part 2 of the Act.The Commissioner would also note that, where a requester has asked for the information contained in a specific report or document, the authority should not routinely withhold the entire report because it considers that some of the report is exempt from disclosure under Part 2 of FOISA.The Commissioner would expect an authority to consider all information within that report to determine if the information contained within it should be disclosed or withheld.The Commissioner would also expect authorities to consider which exemption is most appropriate and apply relevant exemptions to each piece of information it is seeking to withhold.

58.The Ministers' argument seems to be suggesting that entire reports would either be wholly exempt from disclosure or freely released.The Commissioner would note that information rarely falls into simple categories.She acknowledges that requesters may form opinions on information that is withheld if other information is routinely disclosed, but that, in itself, is no reason to withhold an entire series of reports.The Commissioner is unwilling to withhold information in this case simply because its disclosure may lead to speculation regarding information that may be withheld in another case.The Commissioner must consider each case on its own merits.

59.Having considered all of the (limited) arguments put forward by the Ministers, the Commissioner is for the most part unable to accept that the exemption in section 30(c) of FOISA applies to all of the information contained in the reports that are under consideration in this decision.

60.However, as noted above, the Commissioner has concluded that certain information is exempt under section 30(c).This is

Report 7, all information contained in point 3.4, and all except the final sentence in point 3.5

Report 13, information contained under points 5 and 6 in section 4.2

Report 7 ? points 3.4 and 3.5

61.Report 7 relates to an audit concerning the Rural Home Ownership Grants (RHOG) Orkney Project in 2010.The information in point 3.4 and that prior to the final sentence in point 3.5 relates to a particular grant application, describing the circumstances in which the grant was sought and the nature of the property concerned with a level of detail which could enable identification of the grant applicant concerned.

62.The Commissioner accepts that disclosure of this information would, or would be likely to, inhibit substantially the audit process by prompting auditors to avoid presenting full details of particular cases considered in the course of an audit, to avoid intrusion into the private leaves of third parties or creating an impression of wrong-doing on the part of such individuals.

63.Disclosure of information relating to a specific case in such circumstances could also lead to staff members being less willing to contribute frankly and engage fully with the audit process, if they were concerned that personal information and details of specific cases were likely to be disclosed into the public domain in future.

64.The Commissioner is consequently satisfied that the disclosure of the information in point 3.4 and that other than the final sentence in point 3.5 would, or would be likely to, prejudice substantially the effective conduct of public affairs, with respect to the Ministers' internal audit processes.The Commissioner is therefore satisfied that the Ministers were entitled to apply the exemption in section 30(c) to that information.

Report 13 ? points 5 and 6 in section 4.2

65.Report 13 relates to an audit that was carried out regarding payroll in 2010/11.Within section 4.2, points 5 and 6 concern the processes in place at the time of the audit for checking payroll transactions.Whilst it is clear from the report that actions should have been taken to address the issues noted, the Commissioner has received no evidence to demonstrate that this has in fact happened.

66.The Commissioner considers that the sensitivity of the information at points 5 and 6 is such that if it were released then it would have the effect of inhibiting the reporting of future audits, prompting auditors to less fully identify the weaknesses identified to avoid giving rise to the risk of fraudulent activity, and thereby impacting on the Ministers' ability to protect its payroll system from unauthorised transactions.

67.The Commissioner is therefore satisfied that disclosure of this particular information would, or would be likely to, prejudice substantially the effective conduct of public affairs in relation to the internal audit process, and that the Ministers were entitled to apply the exemption in section 30(c) to the information from points 5 and 6 in section 4.2 of report 13.

Consideration of the public interest test

68.As noted above, the exemption in section 30(c) is subject to the public interest test in section 2(1)(b), and so the Commissioner must now consider whether, in all the circumstances of the case, the public interest in disclosing the information found to be exempt is not outweighed by that in maintaining the exemption.It is only if this is the case that the Commissioner can require the Ministers to disclose this information.

69.In their submissions on the public interest, the Ministers considered that there was some public interest in disclosure in the interests of open and transparent government.However, they considered there to be a greater public interest in ensuring that candid and comprehensive audit reports are always produced, to enable staff to identify and learn lessons from them, and continue to develop and improve processes.On balance, the Ministers concluded that the public interest lies in favour of upholding the exemption in section 30(c).

70.In his submissions on the public interest test, Mr Gordon considered that the internal audit process is an integral part of the way that public bodies conduct their business and this highlights good practice as well as bad.Disclosure would, in Mr Gordon's view, ultimately lead to more efficient government and greater transparency and understanding.

71.Mr Gordon went on to comment further, that covering up problems is unhealthy and detrimental to government and the public realm.It is in the public interest, in Mr Gordon's view, for that process to be understood and for problems that have been identified to have been remedied.

72.Mr Gordon submitted that a greater public understanding of this process, which would include a public gratitude for remedying problems, is not a substantial threat to the conduct of public affairs, as the Ministers have argued.Mr Gordon does, however, believe that a genuine threat to the conduct of public affairs is a failure to learn from past mistakes and attempting to muddle through in secret, which he considers perpetuates and exacerbates weaknesses in the system.

73.All of the submissions made by both the Ministers and Mr Gordon have been fully considered by the Commissioner in coming to a decision on where the balance of the public interest lies.

74.The Commissioner accepts that there is a public interest in ensuring that the Scottish Government functions both efficiently and effectively, and that where specific controls, processes or procedures exist, that these are consistently followed.

75.As noted above, the Commissioner recognises that the internal audit process is an important part of assessing compliance with controls, processes and procedures and ensuring the effective operation of all directorates within the Scottish Government.The Commissioner accepts that disclosure of the reports that follow on from these internal audits would go a considerable way to informing the public of the effectiveness of the Scottish Government, and would facilitate a greater understanding of how the Scottish Government and its internal audit process operates.

76.However, balanced against this, the Commissioner recognises that there is a public interest in ensuring that the comprehensiveness of the internal audit process is not undermined, and that the individuals conducting the audit and staff in the area being audited remain able to be frank and open about the matters under consideration, and when reporting findings and recommendations.

77.As the Commissioner has found that the Ministers were wrong to withhold the majority of the information contained within the reports, she considers that the public interest in understanding the audit process, will be met to a significant degree by the disclosure of that information in response to this decision, and would have been met had the Ministers decided to do so following their internal review.

78.The information that the Commissioner has found to be exempt in reports 7 and 13 would contribute in each case to fuller public understanding of the matters under consideration in the report, and the issues that had been identified.In report 7, the exempt information provides fuller detail of the specific circumstances of a grant application and award that had highlighted concerns about the processes followed that are explained in more general terms elsewhere in the report.In report 13, the exempt information provides greater detail of the nature of the system that was being audited, and would, contribute to the public's understanding of the working of the Ministers payroll system.In each case, the disclosure of the information found to be exempt would further demonstrate the thoroughness of the internal audit process in examining the relevant systems and how they work in practice.

79.The Commissioner considers that the public interest identified by Mr Gordon in his submissions would be met by disclosure of the information found to be exempt in reports 7 and 13.However, that public interest carries only limited weight when the very specific nature of the information is considered.In report 7, for example, the issues of concern identified in the report can be clearly understood from the remaining parts of the report, without access to the full details of the particular case that highlighted them.Although the exclusion of the exempt content in document 13 would leave a gap in understanding, this is only in relation to one minor aspect of the audit process and its findings.

80.The Commissioner considers that there is a significant public interest in ensuring that information relating to the specific operation of the payroll system is not used in a manner which would compromise the accuracy and credibility of the data contained on it, and the nature of the transactions carried out, which may result from disclosure.

81.She also considers it to be in the public interest that the privacy of individuals is not undermined by disclosures of details of the type included in document 7.

82.Given the Commissioner's conclusions regarding the likelihood that disclosure of this information would inhibit future internal audits, she also considers that there is weight to the public interest in maintaining the exemption to avoid harm to the effectiveness of the internal audit process within the Scottish Government.

83.On balance, having considered the information contained in reports 7 and 13 that she has found to be exempt under section 30(c), and the submissions from both the Ministers and Mr Gordon, the Commissioner finds that the public interest in disclosing that information is outweighed by maintaining the exemption in section 30(c) of FOISA. She has therefore concluded that the Ministers were entitled to withhold this information under section 30(c) of FOISA.

84.In relation to the remaining information which has not been found to be exempt from disclosure, the Commissioner now requires this to be disclosed to Mr Gordon.As will be clear from the discussion above, the Commissioner is disappointed that the Ministers continue to adopt their class based approach to the consideration of the 20 reports considered in this decision.

85.This approach appears to be contrary not only to decisions from the Commissioner and the Court of Session, but also the Scottish Government's own internal guidance on handling requests for information under FOISA[4].On page 20, this guidance provides specific advice on handling requests for internal audit reports. It states:

"There is no specific exemption in FOISA for internal audit reports ?..This means any requests for such a report must be considered on a case by case basis and the application of any FOISA exemption(s) must be based on the actual content of the particular report requested."

The guidance goes on to highlight (quite appropriately) certain exemptions which might be found to be applicable to particular types of content, where it is present within an internal audit report.

86.The Commissioner has been surprised to note that the Ministers' approach in this instance differs so markedly from their own internal (and published) guidance, and she would recommend that, when considering future requests for information contained in internal audit reports, the advice given in this document is followed.

DECISION

The Commissioner finds that the Scottish Ministers generally failed to comply with Part 1 of the Freedom of Information (Scotland) Act (FOISA) in responding to the information request made by Mr Gordon.

The Commissioner finds that by withholding the following information under section 30(c) of FOISA, the Ministers complied with Part 1:

Report 7 ? All information in point 3.4 and all that prior to the final sentence in point 3.5

Report 13 ? Section 4.2 ? points 5 and 6

However, the Commissioner finds that the Ministers failed to comply with Part 1, and in particular section 1(1), by withholding the remaining information contained in the 20 internal audit reports under section 30(c) of FOISA.

The Commissioner therefore requires the Ministers to disclose all of the information in reports 2 to 21, subject to the redaction of the information specified above by 8 June 2012.

Appeal

Should either Mr Gordon or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Acting Scottish Information Commissioner
24 April 2012

Appendix 1

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(6) This section is subject to sections 2, 9, 12 and 14.

2Effect of exemptions

(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

Appendix 2

List of audit reports

No	Report description	Date of report	Decision
2	Governance and Communities Audit Report on Local Government Finance General Revenue Grant 2009/10	17/11/2009	Disclose
3	Governance and Communities Audit Report on Single Outcome Agreements 2009/10	23/02/2011	Disclose
4	Governance and Communities Audit Report on Controls over the Shared Services Programmes and OneScotland/DirectScot Project 2009/10	12/01/2011	Disclose
5	Governance and Communities Audit Report on Grants to Glasgow Housing Association 2008/09	28/01/2009	Disclose
6	Governance and Communities Audit Report on Affordable Housing Investment Programme 2009/10	4/12/2009	Disclose
7	Governance and Communities Audit Review of Rural Home Ownership Grants (RHOG) Orkney Project	2010	Withhold all information at point 3.4 and all except the last sentence in point 3.5.Disclose all other information in the report.
8	Governance and Communities Audit Report on Senior Staff HR Team 2009/10	06/07/2009	Disclose
9	Governance and Communities Audit Report on Shaping Up Programme Governance and Management 2010/11	17/11/2010	Disclose
10	Governance and Communities Audit Report on Travel Management Procedures and Controls Over Staff Expense Claims (including T&S Charge Card) 2009/2010	01/10/2009	Disclose
11	Governance and Communities Audit Report on Controls over Pension Arrangements 2010/2011	28/09/2010	Disclose
12	Governance and Communities Audit Report on e-HR System Security and Management Arrangements 2009/2010.	15/07/2009	Disclose
13	Governance and Communities Audit Report on Payroll 2010/2011	10/01/2011	Withhold information at points 5 and 6 in section 4.2.Disclose all other information in the report.
14	Governance and Communities Audit Report on Network Management and Telecommunications 2009/2010	18/11/2010	Disclose
15	Governance and Communities Audit Report on Strategic Workforce Planning, Recruitment and Interchange Procedures 2009/10	02/09/2010	Disclose
16	Governance and Communities Audit Report on Data Handling and Information Assurance 2009/10	19/05/2010	Disclose
17	Governance and Communities Audit Report on Freedom of Information Compliance Arrangements 2008/09	04/10/2008	Disclose
18	Governance and Communities Audit Report on Non-Domestic Rates Income 2008/09	06/10/2008	Disclose
19	Governance and Communities Audit Report on Controls over National Performing Companies Funding 2008/09	30/07/2009	Disclose
20	Governance and Communities Audit Report on Broadcasting Grants 2008/09	01/09/2009	Disclose
21	Governance and Communities Audit Report on Review of the Concordat 2009/10	19/05/2010	Disclose

[1] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2010/200900988.aspx

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section30/Section30.aspx

[3] http://www.scotcourts.gov.uk/opinions/2007CSIH08.html

[4] http://www.scotland.gov.uk/Resource/Doc/933/0113676.pdf