Cynulliad Cenedlaethol Cymru

Diolch. I'm Adrian Crompton, the Auditor General for Wales.

I'm Isobel Everett, and I chair the Wales Audit Office board.

I'm Kevin Thomas, I'm director of corporate services and also a board member.

Bore da. Steve O'Donoghue, director of finance and human resources.

Diolch, Cadeirydd. If I may, I'll just ask Isobel to kick off, and I'll come in after her, if that's okay.

Oh, sorry, yes. My mistake.

Well, just to say that the board took the principles extremely seriously when developing the estimate, and we do lay out in the appendix to the estimate how we believe we've met those principles. Our budget requests are limited to new initiatives and a contribution to the pay deal. There's also a value-for-money statement in the estimate. Although we are requesting additional consolidated fund money, it should be seen in the context that our overall budget has decreased, and that's despite inflationary pressures and the new proposals.

Okay, because I was quite struck, actually, by that figure—the increase, if you look at it just in that respect—and I think it's 9.5 per cent if you include the national fraud initiative funding as well. So, you do say in your estimate that you're acutely aware of the responsibility that you have to other parts of the public sector to contain your operating costs. So, as you have done, you'd assert again, then, that your overall, global figure is reduced, although your draw on the Welsh consolidated fund is increasing.

Yes, it's worth noting that the actual increase in WCF is £146,000 [correction: £615,000] when you exclude the cyclical national fraud initiative.

Okay—

Could I—?

Go on then, yes.

Llyr, because this goes to the heart of what—

It does. This is the key issue for me.

—what we're getting to. You'll be familiar with our funding regime. So, we are different to the other directly funded bodies that you see, in having the two streams of potential income. So, we are continually trying to make judgments about whether particular pieces of work we do are more appropriately funded through the fee regime or through the consolidated fund. As Isobel said, in the round, next year, the cost of our work will go down. Within that reduction, an increase in our call on the consolidated fund, yes, but that's more than offset by a reduction in fees. As I'm sure we'll get into, my hope, very much, is that we deliver with that money more and some different outputs that will be more impactful and important.

Before we get into those details, what would the impact be of not getting this additional money from the consolidated fund? That work wouldn't happen—is it as simple as that?

In a nutshell, yes. Self-evidently, it depends, at the margin, quite what we're talking about. There are elements within the additional funding that we've requested that are very directly for us as an organisation—the work around data analytics and cyber security, for instance. There are other elements of the package that are not of huge direct benefit to us as an organisation, but are of wider benefit to the public sector, so, in particular, the element around the graduate trainee scheme and the apprenticeship scheme, which I'm sure we can explain a little more about. So, we would be faced—the board and I—with a conversation about whether we'd simply drop some of our ambitions and not do that work, whether we'd consider shifting an element of that to the fee regime rather than the consolidated fund, or whether we'd simply rein back on our ambitions.

Could I just add a clarification? The £146,000 reduction is in our overall budget, not in the estimate, which does go up, for WCF.

Yes, that's an important point. That's an important point, okay. Yes, of course. Yes, go on, Mike.

What answer will you give to those bodies you're auditing, many of whom would be ecstatic at the sort of rise you're asking for and would be ecstatic at a third of the rise you're asking for, if you go in and criticise them for a whole range of things as part of your auditing, they'll say, 'Well, if we were funded as well as you, we wouldn't have these problems'?

I'm going to let Adrian direct [correction: answer], because it's about quality. [Laughter.]

Well, I'll reiterate the point again, Mike, that our overall funding package is reducing—2.5 per cent in real terms less next year than it is this year. So, it is important to remember those two streams of income that we have. The conversations that I've had with chief executives in local government, the health service and across the public sector in relation to our fees is that they consider that we give them value for money for the fees that we charge, that we don't simply wade in and criticise them, as you said, but, actually, we're doing something that is far more constructive and helpful.

People vary rarely ever say anything critical to those who inspect them, as a rule of thumb. If I went and asked schools about Estyn or I went and asked social services bodies about social services inspectorate Wales, they wouldn't say publicly.

What about these value-for-money studies, which I've never been very happy with? Going back to when I was a councillor, I thought that they were very useful for filling space on a shelf, but actually doing any useful things—. Could you drop some of those value-for-money studies that, quite often, aren't value for money?

Well, the feedback that I've had from chief executives who, I have to say, are not backward in coming forward—I've met them all privately and one to one, so I really think they have had the opportunity to tell me genuinely what they think and not to shy away from anything. You will have seen that more than a year ago, around the time of my appointment, the Welsh Local Government Association were consulted on my appointment, and some of the feedback from the WLGA went to that point of the timeliness and relevance of some of our value-for-money work. I've certainly taken that on board. A lot of what is set out in our annual plan and the estimate that underpins it is focused very much on delivering work that is more timely and relevant for the bodies that we work with.

The feedback that I'm getting already from those public bodies in that regard is very positive, and if you take a look at our forward plan for value-for-money work, you will see a lot of emphasis there on issues that cut across different parts of the public sector, which I think is important and is exactly the message that I'm hearing from leaders and chief executives in the wider public sector, and also issues that are, in my view and theirs, extremely relevant to them at this point in time. For instance, we're doing some work around commercialisation in local government, the impact of austerity on discretionary services, the Well-being of Future Generations (Wales) Act 2015, and so on.

Chair, can I add? I think it's worth mentioning that we're actually looking to charge less to public services next year, so our fee income is expected to fall in the order of £240,000. So, that's fewer charges going through to public services.

But in the context of the national fraud initiative, for a fairly limited spend, the return on investment is over £5 million from the last exercise that we did. So, whilst it does increase our budget in the year, the return to public services is much greater.

Okay. Because I had noted that you say that the resource switch will have

'no net impact on the Welsh Block'.

So, are you anticipating that in making this switch that those organisations that would have spent money are going to give it back or not receive it? Because they'd just spend it elsewhere.

Are you talking about the £180,000 switch from fee income to the fund?

Yes, I am. Yes.

You'll recall when we came before you in July to talk about the Act and the funding regime, I talked a little then about the inflexibility that that places on me in reallocating the expertise and staff resource that I can free up through audit efficiencies to the delivery of some value-added work that is not fee funded. So, this is an attempt to get at that.

In terms of the overall impact on the block, then, for there to be absolutely zero impact on the block, then the logic would be, yes, that money is rebalanced. I think it's important, though, to keep this in perspective. You know, the £180,000 has been arrived at by us looking hard at every one of the audits that we will undertake next year, as we always do. In around a dozen or so of the larger audits, the Welsh Government, some of the larger local authorities and health bodies, we believe that we can deliver our audit work next year for less, and the £180,000 is the summation of those individual elements. For individual bodies, you're talking a reduction in fees of between £10,000 and £20,000.

I think it's therefore important to keep in perspective, you know, £10,000 or £20,000 is important, but in the scheme of the budgets of some of these organisations is pretty negligible. Whether there is an offsetting decision in respect of the other parts of the fund is not a matter for me, clearly, but what I can guarantee is that we will be passing on those reductions to those bodies.

Okay. We've touched on what this will allow you to do. I mean, do you want to elaborate in any way?

Sure. Yes, I'd like to very much. Thank you. The thing that this would allow us to do in particular that we're unable to do at the moment, because of the constraints of the fee regime, is to surface much more of the intelligence and insight that comes from our audit of accounts work. Every time I sign off a set of accounts, I have members of the team who've undertaken that work coming to talk to me about it. And they will start to talk about the body in question, and that work, invariably, has told them fascinating stuff about those organisations. Often it's really positive; these are well-run, efficient organisations, well-led, well-governed, and so on. At other times, it's more concerning and there are important messages there about financial sustainability and governance and so on.

At the moment, I'm unable to surface a lot of that work because of the constraints of the fee regime. This shift would enable me to do a little of that, and I think that's hugely important. I think it's a vast untapped source of information and insight that would be of value to you as Assembly Members and certainly of value to the bodies in question and to taxpayers, service users, residents and so on.

The Public Accounts Committee, at the moment, are in the depths of scrutiny of the Welsh Government's audit of accounts, and that—if Nick were here, he would tell you that is hard, detailed, technical work. And unless you are an accountant and have the wherewithal to delve into the accounts, a lot of that is hard to spot. I want to surface a lot more of that, with products that are easy to engage with and understand, and to draw from that some really powerful insight and messages about the operation of the public sector. So, it's making much more of our audit of accounts work in a way that we simply don't do and can't do at the moment.

Fine. Okay, I could go and ask about staffing implications and the skills mix, and whether there'll be targets and stuff around that, but I presume that's something that you'll develop.

Yes, absolutely. And, you know, this is a first step. Obviously, £180,000 is important, but it's not going to change the world. So, obviously, if we secure this change—I appreciate it's an important point of principle—I would want to come back to you the next time I see you hopefully to demonstrate exactly what you will have seen and received for that money and whether it works. And if it works, then we should do more of it, yes.

Okay, thank you. Mike.

The estimate suggests that the data analytics programme could generate savings of between 5 and 10 per cent of the cost of an audit of accounts. Who actually will get that money? It says it's savings—is that going to be real savings as in if you charge an organisation £200,000, then between £10,000 and £20,000 will appear somewhere on their balance sheet?

In terms of our data analytics work, we saw you earlier in the year to demonstrate some of the progress we've made in that regard. A lot of what we've achieved so far has enabled us to deliver richer, deeper insight—some of you may have seen some of the interactive data tools that we're now routinely publishing alongside our more traditional reports. Some of our work, though, has been focused more at the process end, automating what would have been manual processes, and those are some of the efficiencies that you're seeing us pass on to audited bodies.

The 5 to 10 per cent is a very early estimate of what we think could be the big prize if we're able to deliver what we're calling 'data enabled financial audit'. That is several years down the line. We're working very closely with the National Audit Office and our partner audit bodies in the rest of the UK on this. We're all at more or less the same stage. But if we can achieve that, it would mean large-scale ingestion and processing of data that would make automatic what are now laborious manual tasks. If we can achieve that sort of saving, then, yes, that would be directly passed on to the audited bodies—absolutely.

And the £180,000 increase for your data analytics—is it a one-off or are you putting it into your base budget?

So, we're in the middle year at the moment of a three-year programme that this committee has supported in relation to data analytics. I have seen more than enough now to be convinced that it is the way that we should be going. For us really to crack on and make this mainstream, rather than a selection of nice ad hoc stand-alone pieces of work, we need to invest in our infrastructure to create some serious secure, expandable storage capacity so we can take in large volumes of data and sensitive data, and we need to enhance some specialist capabilities around that so that we can maintain that going forward.

So, an element of what we're looking for is to put that in place, but whether or not we continue with that, I would say, 'Yes, we do', because, for me, data analytics is definitely the way that we should be going. What I don't want to be doing, though, is coming back every year and asking you for £200,000 here and £150,000 there; it needs to be mainstreamed into our baseline budgets. As I said, we're halfway through that three-year initial programme. I would certainly envisage this time next year explaining to you how we are mainstreaming that—whether we build some of it into the fees that we charge to audited bodies, just as a routine overhead of what we do, or whether we build it into the main body of the consolidated fund.

So, if I can simplify it, it is going into your base budget.

A significant element of funding for data analytics has to go into our base budget, yes.

Sorry to keep pushing on this, but how much of that £180,000 is going into your base budget? I mean, rolling forward a year, some of us might like to be here, or we'd all like to be here, but it might be different people here—will they just see £180,000 being rolled forward, or £80,000, £120,000, £10,000?

Steve will come in on this, but the fundamentals of the broad scale of our spend on data analytics, which is that £180,000 plus the sum that was already in there—yes, that will be rolled into our base budget. At the margin, that might differ, because, as I said, there are some specific things we need in the coming year.

But you're putting it into your base budget—

Yes.

That's the point I was trying to get across.

The other question I've got: you talk about cyber security, which I wish you luck with, because lots of people spend a lot of time and a lot of money on it and remain optimistic. I go along with the band who say, 'If you really want cyber security, you come off the internet. You don't plug into where people can come into you.' I assume you don't want to do that. It's going to be very—

Always good advice, Mike. I'll follow that. [Laughter.]

Actually, for a lot of things, it is incredibly good advice, because people have things that are able to be got at from outside that no-one outside should ever need to have access to. But I'm just having a bit of a preamble—[Laughter.]—with Alun Davies. It probably does not have any benefit to us—

We'll need a budget for chalk and slate as well. [Laughter.]

But what do you mean by 'digital vision'?

We've reported to the committee previously that we've, over the past three years, carried out three strategic transformation projects. The first of those was called Cutting Edge, and some of the recommendations from that project led to the creation of the data analytics team that Adrian's been talking about. But one of the other recommendations was that we create an overarching digital vision and strategy for the organisation, to look at how we can use technology to improve business processes and also to support more flexible, more agile working, which links to the third of our transformation themes around how we actually deliver our work.

We've got an ambitious change programme in place to realise that vision, and we're drawing on expertise from right across the organisation to help realise that. So, that's not just, if you like, the usual suspects from our information technology team, but also people from our financial and performance audit practices, our audit trainees and also our communications and HR professionals. We're looking at a range of digital initiatives at the moment. One of those is we're looking at artificial intelligence and whether or not that can schedule meetings for us. We're looking at how we could use technology to record interviews as part of our audit work and then to transcribe those interviews, and we're also looking at robotic process automation to simplify and carry out basic administrative tasks, thereby freeing our staff up to do more value-added work.

Thank you. And finally from me, you've got £170,000 for website development, to purchase software and to provide training. Is that a one-off or is that being built into your base budget?

The investment for website development is intended to be a one-off. That's an element of that £170,000, around £50,000 to £60,000. What we're looking to do is to commission a Drupal developer to help us overhaul our website, which, in turn, will help us to realise some of the ambitions set out in our annual plan in terms of increasing the impact of our work, increasing the reach of our work and also making sure that our work is as accessible as possible. What we did when we last revamped the website, around six or seven years ago, and it's proved to be very successful, is that our in-house communications and IT team professionals worked alongside the external developer, developing their own skill sets so that once the developers finished their work, they were able to run and maintain that system on an ongoing basis.

Thank you very much. Rhun.

If I can, I'll just give you a bit of context to make sense of my answer. The graduate trainee scheme has grown significantly over the last few years—from nine or 10, I think, in 2015, we're up to around 50 graduate trainees now in the organisation on a four-year training programme. So, it's now become a significant part of the organisation, a significant part of our delivery model.

An important element of the programme that we offer to the graduate trainees is for each of them to undertake a secondment out to another part of the public sector in Wales, so, so far, I think around 30 of our graduates have been placed on secondment to 20 or so organisations elsewhere in the public sector. The feedback we get from those bodies is fantastic, and I think it's a really important part of the programme we offer.

An element of the additional funding that we've asked for in the estimate would enable us to offer that secondment opportunity to every one of our graduates, rather than the more limited number that we do at the moment, because of the increase in the scale of the programme. That's roughly a third or so of the £100,000 that is in the estimate in this area. The other elements are focused on our apprenticeship programme, rather than our graduate entry programme. So, that, too, we're trying to expand. We have, I think, in the organisation now six audit apprentices, three business administration apprentices and a couple of data analytics apprentices. So, it's something I'm very keen on that we're trying to develop as well.

We're picking up messages from the wider public sector that they, too, would like to see us do something similar in respect of apprentices as we do for graduate entries. And so the funding we've asked for would be focused next year on two things: (1) on building up that offer with partners in other parts of the public sector so that, this time next year, ideally, we would be running a recruitment campaign to take in 20 or 30 apprentices who will be focused on finance apprenticeship, who would be dotted around the public service in Wales. The other element is to enable us to work with a charity called the Social Mobility Business Partnership, who specialise in extending the reach of programmes like that to more disadvantaged communities so that we hopefully attract intake from black, Asian and minority ethnic communities, socially deprived areas and so on. So, those two elements there are focused on our apprenticeship offer. And, as I said right at the top of the day, the wider benefit for the public service is what we're after there, rather than us directly as an organisation.

On that last point that you raised about trying to achieve better social diversity and inclusion, that needn't necessarily come down to spending more money, of course. Had you done the right things or different things earlier on, perhaps you would have a better balance of who you have on your schemes. Why are you unable to achieve, do you think, that desired level of social diversity within the programme as it is, or why have you been unable to?

The programme itself—the graduate entry programme—we are successfully attracting a diverse mix of candidates to that. The apprenticeship programme, as I said, is very small at the moment. But I think it's fair to say there is a perception amongst some communities that a career in the public service is not one that they instinctively consider is something for them, let alone a career in finance as a profession. It's something that simply doesn't hit the radar. And so I think, undeniably, there is a lot of work for us to do to try to break down some of those barriers and demonstrate that the WAO—. People need to know what the WAO does, because it's not transparent to a lot of people, I'm sure, and certainly a lot of younger people. So, I think we are having some success in terms of our graduate entry programme. We do a lot of work with the universities in terms of outreach to build understanding and awareness in that regard, but there is a way to go for our apprenticeship stream—

And you need that external link with that charity that you mentioned. You don't feel able to do it yourselves.

Yes. That extra work will fund the capacity internally to allow me to release the staff to do that work.

I think it's worth adding that it's about tapping into expertise that is out there already, rather than trying to create that expertise ourselves. And so we'll learn from that expertise, but we're certainly not doing it in isolation. So, in the finance skills development group, we're working with sectors across Wales—Welsh Government, the National Assembly, the parks, fire and rescue as well. So, we're not working in isolation on this, it's about working together but tapping into that expertise that already exists out there.

Could I just add one more thing, Rhun, that I think is important: part of the reason we're doing all of this is so that we start to build some capacity in Wales in this field. So, home-grown finance professionalism. It's still quite early days, even for our graduate trainee scheme, but we're starting to see the first intakes coming through the programme. So, last year, of the 10 graduates that left our programme, six remained in the public service, five remained in the public service in Wales. It's early days, it's small numbers, but I think we are achieving the desired effect in developing that talent pool internally. 

Sorry, Rhun, I think Rhianon just wants to come in on this issue. 

Very briefly, if I may, Chair. So, in regard to social diversity, we're very well versed in terms of the whole diversity envelope. I did mention this in a different committee around economic diversity in terms of social class. So, what you're saying is that you recognise that as well, and you're employing the charity to do this for you in that regard. As a whole, as an Assembly and as a Commission—and I'm not asking you to speak to the Commission—are there key performance indicators around an ability to bring in youngsters around apprenticeships, around a social diversity basket? 

I can't speak for other organisations. Clearly, the numbers of individuals that we have would allow us to have quite a granular feel for the backgrounds from which they come. We don't at the moment have a KPI as an indicator for the organisation—

But it's something that you feel that is important to do. 

With this piece of work, absolutely—I think it's really important. 

Thank you. Rhun.

Turning, if I may, to the £120,000 identified as needed as an increase for running costs, how much of that relates to funding for the pay agreement? And apart from turning to the consolidated fund, what other methods were investigated as a means to reach the needs of that agreement? 

I think it's important to reference the guidance from the Minister for Finance and Trefnydd, who wrote to us to say it was reasonable to work on the basis of 2 per cent pay inflation increases for next year. So, the total cost of that on our pay bill is around £320,000 for next year. The context is that it's the first time the board sought additional funding for pay increases since its creation. Previously, increases have been funded through our savings and efficiency value for money programme; that's set out on page 9 of the estimate in some detail. But also, we look at savings that we can generate in the year. So, even though we're looking for this additional funding of £120,000 as a contribution to the pay settlement, there is still a savings target next year of £476,000. What the board concluded was that to put the pay increase on top of that savings target would be a high risk to our financial position and would be unaffordable.  

It's one of those questions that's the same kind of question that Mike Hedges asked earlier on—there are lots of other organisations that have had to find ways of paying for pay agreements from within current budgets. You're comfortable, as a matter of principle, that you're putting your hands up and saying, 'No, we can't do this. We need additional funds'. 

I am comfortable, and it's important to recognise that this is an apportionment to the consolidated fund; it's not the entire cost of the rise. So, two thirds of the increase in our cost base will be passed on in those fees, but there are fees that we are capping and driving down. So, we are, through our own internal efficiencies, eating up a lot of the additional costs that come with that. 

You note in the estimate that, without the increase, you would need to increase fees by 13 per cent. How do you reconcile that with the 'no more than full cost' rule? 

We only have two sources of funding, so what doesn't come from WCF is then apportioned through our fee rates. So, the 'no cost' rule, if WCF provided nothing, all of our costs would need to be funded through fees. But I would say we'd have other options. One of those options, for example, is not to allocate 2 per cent to pay increases, another around whether we increase fee rates by that percentage, and another around reviewing our whole spend again. At the moment, what the board has said very clearly is the board believes that these are the resources that the auditor general needs to deliver his programme and, on that basis, we're apportioning some to WCF for the pay increase and another to fee rates. 

Rhun, just to be clear as well, the 13 per cent—so, this is on page 30 of the estimate—relates to the whole £1.8 million contribution to running costs that comes from the consolidated fund, not just the £120,000. 

Mike would like to come in on that. 

I'll make one comment and ask a question. There's not an organisation in Wales that would not like to be coming in here, being able to outline all their needs and expecting them to be met. My question is: what about savings from staff churn, when you see people leaving, people joining, the gap between somebody leaving and somebody joining? Other organisations are using that as a means to fund pay increases, because the Assembly, or the Welsh Government, are not as generous as the Assembly is in finding money for people.

We take the approach of already factoring that into our estimates. So, our pay salaries are reduced by the amount of turnover we expect in a year. It's been running at about 10 per cent. So, we're not asking for that money and then redeploying it on to pay. We're asking for a lower level of money in the first place. 

Okay. Rhun. 

To another part of that £120,000 running costs increase, specifically relating to governance, what would you be unable to comply with, in governance terms, if you were not able to receive the additional funding on governance?

It's a really small element linked to governance. So, the £120,000 is part of a group of costs that amount to £1.8 million. They cover things like our technical support to audits, quality assurance, a contribution to the pan-Wales travel costs, so that authorities in north Wales don't pay more for our auditors to travel there than authorities in south Wales, and then a small element is around running the board and supporting the Public Audit (Wales) Act 2013. So, for example, every time an amount of money is issued from the Welsh consolidated fund, someone in the Wales Audit Office has to verify that that is in line with the budget ambit, so that's across all bodies that draw from the fund. 

The amount allocated to governance is around £300,000, and a very small proportion of that £120,000 links to salaries related to that. 

I think, potentially, there's just a bit of confusion there. It goes back to page 30 of the estimate, that, within that £1.8 million is an element associated with governance. The £120,000 addition to that is specifically for pay rise, so, obviously, pay rise of staff who are associated with the governance functions—pretty marginal. 

And that answers clearer my first question as well. So, it's entirely on pay rise. 

On the capital programme, you are looking for increases, over the next five years, with a peak of £800,000 there. In addition to what perhaps you've told us already about ICT programmes and corporate systems, is there anything else coming from that capital spend that you can tell us about, or has that been included in the kinds of new mechanisms, new ways of working through ICT, that we've already discussed?

Most of that's picked up there. The big spike relates to our estate. Kev will explain a little more in detail, but we have three offices—one in Cardiff, the lease on which runs out in three or four years' time. We have smaller offices in Abergele, in Penllergaer, and the leases on those break over the next coming years as well. So, that big spike in expenditure is just us flagging up to you that there will be, when the Cardiff lease expires, in particular, some significant costs associated with office relocation most probably. But, Kev?

That's absolutely right. The board reviewed our updated estate strategy at its September meeting, which covered very much this issue around potential office moves over the next three years, as those three leases on our three main offices come to an end. Our leases on our buildings are the largest element of non-pay expenditure in our budget, and when the board considered the estate strategy, the clear direction was that any future office moves should lead to reduced running costs. So, that will be a key factor when we look at our plans post those leases expiring. 

The estate strategy itself has been informed by the third of our transformation projects, which very much looks at the ways in which we work, looking at how we can use tools and technology to more effectively deliver our work, and make best, most optimal use of the buildings and sites from which we work, which may no longer be the traditional office-based sort of accommodation.

So, that's very much what we're looking to do with this estates strategy. It's important to say that the spike in year three of the capital programme is very much our best estimate at this stage. We just thought it was important to flag up at the earliest possible opportunity with this committee that there is likely to be a need for investment at that point. But any investment would be on the basis of invest to save.

But it could be greater than that, if it's an estimate.

It could be greater than that. I think all I can say at this stage is that, as our plans develop and crystallise, we would of course continue to engage with the committee, so that we're fully in the loop on that.

And I recognise that a lease is coming to an end, but how unavoidable was this? Is there work that could have been done that would mean that this wasn't a necessary spike coming up in a few years?

I think that the lease, for example, on our Cardiff building will have been 15 years old by the time 2023 comes. The staffing of WAO has changed an awful lot in that period. The way in which we work has also changed, and I think is likely to change again as we move into the future. So, we need to find office accommodation that is still fit for purpose. The likelihood is that we would look for an alternative to the current model, because we want our staff to work more flexibly and more effectively for the future.

And you've said that you consider this to be an invest-to-save programme—we'd expect that, I guess. What are your estimates on the kinds of savings that you would expect to make as a result of the decisions you'll make over the coming years and when we'd start to see those savings coming through?

Well, when the board debated this in September, the board wanted to set exactly that target—'You need to work on the assumption of 20 per cent cost savings.' We were advised against it until we'd received the report about the likely footprint, the likely locations and the likely rentals that are out there, before we put an actual savings target on it, because, otherwise, we're just shooting in the dark. So, it's clear our footprint isn't quite the right, as to the size of space at the moment, but we are awaiting—. Is it March we're coming back, with the next stage?

The next stage, yes.

But we were very clear that we have to reduce our ongoing accommodation costs. But I can't give you that figure because we haven't got enough information at this point.

Okay. You've explained that that's the bulk of the capital expenditure. There is certainly some significant expenditure that you're planning on ICT infrastructure, corporate systems—the budget rising to £200,000 by 2023-24. Going back to my original question, does that refer to the kinds of items that we've been looking at already in this evidence session, on changing the way that you operate and allowing you to give more meaningful data and analysis?

It covers a number of those. Probably the one specific one that we haven't already covered is the replacement for our financial audit system. We currently use a system called MKinisght, and that's a system that we and all of the other UK audit bodies use. In 2021, our contract comes to an end, as it does for those other UK audit bodies, and it's important that we find an effective replacement system for that. It's not just a system that we use to record our audit work; it also supports us in maintaining the high quality of our audit work, so it really is a key issue for us. We're already looking at options for replacement. They range from things like internally developing a system, where we could look to extend the system that we currently use for measuring [correction: for recording] our value-for-money work. At the other end of the spectrum, we could look to procure a new system from a new provider. It's also important to say that we are working in partnership with the other UK audit bodies. We're all in the same position with this need to replace that system. And of course, working in collaboration with those bodies does give the advantages of shared experience and expertise in this area, but also there's the potential to achieve a more cost-effective solution, because the combined purchasing power of those organisations would clearly be greater than just a single procurement exercise.

And, again, this would be a one-off exercise, albeit spread over a few years. When would you expect the next—? Or, to ask the question in a different way, how long would that investment buy you a system for? Would it be a 10, 15-year investment, or—?

I think the typical lifetime of the system that we have at the moment was five-to-10 years. That's the way we budgeted it. Normally, over that period, things become obsolete, new auditing standards come in, so we would need to look at a replacement. But the typical lifespan would be five to 10 years.

Okay. Thank you.

Okay, thank you very much. We're going to move on now to Mark Reckless. Mark has a few questions just to conclude our scrutiny of the estimate, and then we'll be moving on to the annual report. I just remind Members that, if you do have any questions about the estimate, then it's best to get them in after Mark's, now. Mark.

Looking at the trajectory of your budget from this year to next and what should be the related issue of workload, can you describe to us what approach you're taking to the EU agricultural funds audit work, and how that feeds through to workforce and budget between the two years?

It's tricky, because it's uncertain. Our estimate has been put together on the assumption that we would have left at the end of October, with a transition arrangement in place. Clearly, that's been overtaken. If we were to leave towards the end of January, I think the broad thrust of the estimate would still hang together. So, we are faced with a conundrum. At one extreme, if we end up leaving without a deal, and that agricultural funds work comes to a sudden end in the early part of next year, then we would be left with a funding gap.

The other thing that is relevant in this context is the fact that we're bringing in-house the work that, at the moment, we let out to the private sector to undertake some audit work on our behalf. From the start of the next financial year, that work will be brought in-house.

Relating to EU agricultural funds, or more generally?

Not related to the EU, just more generally. So, the estimate offers the possibility of quite a neat fit between those two elements. At the end of the agricultural funds work, the staff who are currently funded to do that could be redeployed to undertake that work that we take in-house. Obviously, if that neat fit doesn't occur, either we're left with a funding gap, where we either have to pay off staff that we have at the moment who are no longer funded through the agricultural funds work and then, a few months later, re-employ staff to undertake work we're taking in-house, or have funding that sees them through that period, and redeploy them to undertake some of the work that I described earlier in the session before they can be undertaking the financial work that we're taking in-house. So, it's tricky for me to give you a categorical position, because it's so fluid.

But is what you've got now—is it consistent with what I understand is current Government policy now, which is to leave at the end of January, and then have a transition and implementation period that only goes up to the end of December next year? Is your budget and workload—is it consistent with that trajectory?

I'll ask Steve to come in. I mean, broadly, yes, because, as I say, the estimate has been put together on the assumption that we leave with a deal that runs to the end of 2020. That will mean that we'll have the flexibility in our staffing that we need to—the funding income through the agricultural funds work to keep those staff in place and the capacity then to take on the work that we're bringing in-house towards the end of the year. Steve—he's a numbers man, so he might want to be more precise.

I was going to say 'broadly, yes' as well. [Laughter.] But in the context that this is the approach we've agreed across the Public Audit Forum of the UK. So, all of the audit bodies are following this approach of budgeting through to the autumn with the expectation that work will end then. If it ends sooner, the financial risk we're facing is a maximum of £760,000. Clearly, this is on our risk register. There are options and the possibility of us reclaiming some of those costs from the Department for Environment, Food and Rural Affairs in the event of us not being able to undertake the work. So, it is a moving picture, as the auditor general said.

Sorry, Mark, Mike would just like to pick up on something.

You're talking about ways to deal with that shortfall, but what about holding vacancies during that time? The last question, the last but one question from Mark Reckless—when you said we could either employ people or keep people ready for it, what about holding vacancies during that time and then filling the vacancies when the work comes in?

I think there's an issue around, if we make people redundant because the work is no longer there, there is a cost to that and we need that expertise later in the year. What we do do, Mike, is, for every vacancy, we fill in a business case before we fill it. So, we don't fill for the sake of it.

I'm sure there isn't an organisation that doesn't say that. Sorry, I'll try and make myself clearer. You expect to have a possible shortfall in income and an excess of people during a short period of time. What I was asking was: why don't you hold vacancies during that time, so you don't have to make anybody redundant, you don't have to—. You just hold. If you have five vacancies, you just hold those vacancies, redeploy people during that time—[Interruption.] Alun, I think I saw that you want to say something.

I think it's micromanagement—I think we need to look at the broad thrust.

You might think it's micromanagement; I don't think—

I'm allowing you to speak, Mike. Come on, make your point. 

I just think it's about trying to get from an organisation how they're going to manage expenditure that they're asking to be funded. 

Of course, Mike, we do exactly that sort of thing. We try to manage within our resources and smooth fluctuations like this all the time, and that would be an element of what we sought to do. The loss of income we're talking about here, though, is a significant one for us. It's not something that we can simply ignore and think that we will have enough capacity in the organisation just to keep a few posts vacant. 

Okay.

Can I just try and tease out with this whether we have any express or implicit assumptions about what's going to be happening in terms of any agricultural support post Brexit? I understand there's uncertainty around that and the potential for a new approach of public money for public goods, and I just wonder: is your office assuming that you will be getting any income for auditing agricultural support arrangements, whatever they may be in future, and is the issue that we're just not sure what those are going to be, or is the issue the way the EU has done this is particularly intensive in terms of the audit requirements around it?

Yes, very much the latter. So, I responded to the consultation on the future shape of rural and agriculture support recently to make exactly those points. So, assuming that alternative support packages are put in place, then the sums involved in my view would necessitate some form of audit. I would be very surprised, and I don't think it would be wise, for the level and precision and depth of that audit to be the current model that we exercise, because it is exceptionally detailed. So, I think there is a lighter touch approach that we will need to have in place for any replacement regime. But, obviously, we don't know what that will look like at the moment. We don't know the shape of the scheme, whether audit requirements and duties on me will be placed into the legislation that underpins that, or whether I need to come at it just through my work on the wider Welsh Government account. At the moment, we just don't have that clarity of detail.

Chair, can I now move on to the—

Yes, to the annual report and accounts for 2018-19. Thank you, Mark. Thank you. 

Thank you, that's very helpful. In your foreword to the annual report, Adrian, you say that you're hoping to unleash the full potential of your office. What's been holding back the Welsh Audit Office to date?

Steve informed me that the Prime Minister used the same—

I wasn't going to say it, but now that you have done it—. [Laughter.]

Coincidentally or otherwise? 

The Auditor General leads, the Prime Minister follows. [Laughter.]

I hope you do a better job.

What's holding us back? So, I was appointed just over a year ago, and I think that you would expect, and any of us would expect, that any chief executive coming into an organisation is going to come at it with fresh eyes and provide some fresh direction and impetus. I was very lucky to come into what, self evidently to me, is a very high performing organisation already. But, as I mentioned early on in the session, what struck me very early was the incredible depth and breadth of expertise and perspective that we have within the organisation. I feel very strongly the weight on my shoulders of having this unique and privileged position, with a line of sight across the whole of the public service and the authority and independence that is enshrined in my office. I think that we do a fantastic job at the moment in terms of delivering our statutory responsibilities and delivering the suite of studies and support and programmes that we do at the moment.

Where we're less good, in my view, is seeing the synergies and connections that exist between all of that—seeing the picture that emerges because of our unique perspective across the whole of the public service. And, as I said in the earlier part of the session, I think that there's an awful lot more that we can do in surfacing much of the richness of data and insight that exists within our audit of accounts work. So, those are the areas that I want to unleash.

The focus of our annual plan and the ambitions that the board and I now have agreed for the organisation are very much in that space and about raising the visibility and the impact of the organisation and of the work that we deliver. I'm not just saying this: I genuinely think that our impact and support for this institution, for the public bodies that we work with and for the wider public—we could do so much more than we do at the moment.

The mood in the organisation is that everybody's up for that—a really positive response to that new direction for the organisation. And this is my first opportunity, if I'm honest—. I know that I was here a year ago, but this is really the first time that I've appeared before you to present an estimate that has been shaped by that, and genuinely shaped by the direction I'm trying to take the organisation.

Given that you have just been in place for just that year, I wonder, as well, if I could direct a question to you about your statement at the beginning of the report. You say:

'Overall, we performed well...we achieved many of the challenging targets we had set for our key performance indicators.'

Isn't that an overly rosy summary when, of the 26 performance targets, I understand that you've only met 11 of those? 

Okay. I don't think that it is overly rosy, because we do scrutinise all of the KPIs on a regular basis. And, inevitably, with the KPIs, some of them mean more. So, for instance, if we miss the target on website hits, for instance, I'm not going to worry. I'm going to worry, though, if quality dips. I'm very keen to get better KPIs around impact.

I'm just trying to get the page up for me. So, as you will have seen in the interim report as well, some of them are orange. But I think that that reflects the nature of the ambitions that, this year, in this year's annual plan, we are doing. So, I want to just assure you that we do scrutinise them, and I'm happy to answer questions on any of the specifics that you're worried about.

Well, if I could perhaps drill down to one specific, and, again, given it's been the first year under—I certainly don't want to make any personal suggestions by highlighting this and, obviously, we are well aware of the quality of Adrian's work from his prior role. But this—. The number of staff feeling positive about our leadership and change management—only 42 per cent. On the face of it, that would seem to be cause for concern. Why is that?

Okay. I'll give a little bit of context, and then I'll ask Adrian and Steve to go for that one. So, the staff survey—at that point, we had just lost Huw as auditor general, Adrian had just come in, and everyone was sort of watching. We hadn't declared the vision and ambitions—that came after this result—and, similarly, people were beginning to be aware of the amount of change that the board was looking for. So, some of that's the context. And you've got—. Would you like to say something about the leadership? 

Sure, yes. Over the last year, I've focused a lot on this regard. So, that struck me as well and so I've invested a lot of my own time working with my leadership team on the senior leadership that we deliver to the organisation. I think that some of what underpins the responses that we saw a year ago were a sense—. There was a lack of clarity in responsibility, slightly cluttered structures in our leadership and management, and I tried to clear away some of that to give it a much clearer, cleaner picture.

In terms of my senior leadership team, I've changed the membership of that to respond to an issue that came through quite strongly in the staff survey, where staff wanted to see that senior team reflect more overtly the overall balance and structure of the organisation itself. I've done that. I've also brought onto that team a number of staff who are more junior, at below director level. Indeed, one of them is one of our graduate trainees. So, I opened up an expression of interest exercise to all staff in the organisation to join the executive leadership team—without pay, but just to contribute to the organisation. I was bowled over by the response to that, and in the early months of observing that myself, I've been delighted by the dynamism and energy and change of atmosphere that that's brought.

Tomorrow is the closing day for this year's staff survey, so if any of our staff are watching this on Senedd.tv and you haven't filled it in, please do so now. So, we will get an updated picture then, but everything we've talked about flows from the leadership of the organisation. If we don't get that right, we're going to fail across the piece. So, I take that absolutely, extremely seriously.

The second part of that question that you mentioned, Mark, is about change management and, in fairness, I think the staff survey was absolutely right. My observation is that we have not been great at managing change in a coherent way across the organisation. So, at the start of this week, our new change programme manager was appointed and joined us, which I'm delighted about. Her first role will be to start to brigade together the various change projects and initiatives that we have across the organisation, so that we can govern and manage those in a far more coherent, joined-up and sensible way, which I hope—maybe not this week, but it will certainly feed through into a much more effective way of managing change in the organisation.

We spoke last year in terms of setting your suitability to lead the office, and the priority wasn't to have an additional auditor with the technical expertise to support more audits, but the overall approach to leadership of the office, managing change and relating with partners and the rest of the public sector in Wales, and your skill set with that. I just wonder though, in terms of the transition and you coming in and leading the organisation, has it, in any way, been a challenge for you not having the auditing, the accounting and technical background in terms of leading, liaising and working with any of your staff? Has that been a challenge for you or them in any respect?

That has been one of the many challenges I've faced, but it's certainly not top of the list. I'm brilliantly supported by very, very able and supportive professionals who know that world inside out. So, my focus has been more on corporate organisational leadership, and my lack of technical background and expertise has not been a barrier in that regard. If anything, in terms of the earlier topics of our conversation and the sort of contribution I think the WAO could make, and I want us to make, some of that comes from the fact that I'm not an auditor; I don't read these accounts in the way that a lot of my colleagues do—you know, as though they're reading a book. It needs some interpretation for me, and because I can see that, I think I can recognise that other people need that as well if they're to get everything out of it.

One other area just to—

Very briefly, then.

For me, a disappointment on the survey was that only 52 per cent of staff felt positive about the learning and development arrangements, and I just wondered why that might be. And, also, you said that the survey's just closing—what would you like to see the proportion coming in as for that, and also for the leadership and change management we were discussing for this year?

I'll ask Steve to cover the learning and development topic in more detail shortly. I won't give you a target figure—that would be risky. Given the effort that we've put in over the last year, I will be disappointed if those figures aren't moving in the right direction. In terms of the leadership and change scores, of course, it's one thing for me to do lots of things in a structural sense with individuals at the top, what really matters is when that starts to percolate down and people feel it and see it for reality in their day-to-day jobs. Whether that has happened across the board yet, I don't know—the survey will tell us. So, I hope that we're moving in the right direction. I would be surprised, though, if I don't come out of it feeling as though there's much more that we still need to do. Steve, do you want to—?

Well, could I—? Alun, I think, just wants to make a point as well, because I would like to make progress now.

Can I say, it's very refreshing listening to your answer to that question? I think sometimes we don't have enough focus on corporate culture and leadership and how that affects the structure of an organisation and performance of any organisation. I was wondering if you could say to us a little about the corporate culture that you've found, because some of these numbers don't, on the face of it, look very impressive in terms of the annual staff survey, and how you intend to make those changes in terms of your own leadership and management style. And if you could describe to us the sort of culture that you would anticipate and expect to see within the organisation.

Yes, sure. Firstly, in the context of the wider public service and the civil service—we follow the same survey approach—these are not bad at all.

Yes, but you're not comparing with the best of organisations sometimes. [Laughter.]

Forty-two per cent of staff feeling positive does not mean that 58 per cent feel negative. There's a bigger chunk in the middle who just don't express a view.

Yes, I get that. That's an important point.

But I take your point. The nature of our work means that we are a hierarchical organisation. Some of that is driven by the auditing standards that we have to employ in the course of a lot of our work. Part of what I'm trying to do is—I'm trying to avoid saying 'unleash our potential' now—to empower people more to take decisions and act on their own initiative. I do a lot of talking to the staff and I get around as much as I possibly can. The quality of individual we have in the organisation from top to bottom is exceptional and I believe we've got plenty of control, structure and governance in place to trust people a little more than we have in the past, and that's a big thrust of what we're trying to achieve at the moment. And that, in turn, of course, delivers efficiencies. That means things can happen more quickly and more smoothly and that we don't get tied up in process all the time. So, uncluttering and releasing some of that is important, not only in terms of the culture of the organisation and our ability to deliver, but also in terms of our internal efficiency and the cost of running the place.

Okay, thank you very much.

Rhianon.

Thank you for that. With regard to the levels of risk that have been identified, the board considered a summary of the key strategic risks, as you know. Can there be some sort of extrapolation with regard to 'failing to embrace the opportunities presented with the appointment of the new auditor general'? What's your understanding of what that means? Can that be fleshed out for me?

That's in the annual report and accounts, is it? Yes.

Moving on. 

The context at the time was that the auditor general has this absolutely critical appointment and has to command the trust and respect of all the bodies they audit as well as the Public Accounts Committee and as well as the Finance Committee. And this was still very early in Adrian's tenure. Am I making sense? That was the context of it. I haven't—which page are we on? Sorry.

So, with regard to the annual report, it was one of the focuses around the issue of Brexit, around the loss of EU grant audit work, tendering for contracts, the response to the people survey, which you've already addressed, and failure to address the opportunities presented with the appointment. I'm just trying to understand what that means in terms of the context of what we're talking about.

These are some of the headlines from—

They're the key strategic risks that are identified within the—

[Inaudible.]

I'm just trying to understand more.

Remember the day when I challenged the—

Yes, you did.

[Inaudible.]

I don't understand what that means.

Taking advantage of my arrival seemed to go on for an awful long time.

Okay, I see.

In terms of that one in particular, there was an obvious risk to the organisation in losing one auditor general and a new one coming in. There's also an opportunity for me to help set a fresh direction, and an important part of my response to that also was to undertake a programme that saw me going around Wales to try to meet just about every one of the chief executives of the major bodies that we engage with, as I said to Mike at the start, to get their genuine feedback on what we do and how we do it.

But these are some of the headline strategic risks that we faced during the year, and I can assure you that I, through the executive leadership team, have a very consistent focus on that. We're very clear that this needs to be a living thing, rather than just a list of difficult issues that stays there for the year. So, they're constantly being refreshed and the board rightly monitors me on that as well and considers the risk register at that level on a frequent basis.

Okay, thank you. So, with regard to the new management committee, or the old management committee and its new formation in terms of the members that you've got on there, why do you think that was necessary to do in terms of that change?

For many of the reasons that I touched on earlier—that our internal leadership and managerial structures were a bit cumbersome and cluttered, and that fed through into slow decision making and a lack of clarity and accountability in responsibility. So, that's very much been the focus of the steps that I've taken to make more clear where responsibility for strategic leadership lies, as I said to Mark, to make sure that the membership of that group has representation that mirrors the broad structure of the organisation itself.

The step that I took myself to bring in the employee membership was designed just to give me an entirely fresh set of voices around the table, some fresh perspective and a change in the environment of that group, but also the message that it sends to the organisation as a whole that the senior leadership team is not, in some way, a bunch of the senior staff who lock themselves away in a room and take great decisions.

Thank you. So, with regard to being more closely aligned with regard to the breadth and timeliness of the focus of the work of the old management committee and the board, you think this new arrangement has met that regard in terms of being more closely aligned.

It's certainly taking us in the right direction. It's early days—the changes I made were in the early part of the summer. It certainly is moving in the right direction. The wider leadership team, the wider group of directors, have also undertaken a lot of work themselves, and I've been delighted with the response that I've received from them. But these things—No. 1—take time to have some effect, but also they're not stand-alone things that you do and that's job sorted. You have to have a constant focus on it, which I do have.

With regard, then, to the board's self-assessment of their effectiveness and the resulting actions for the board, there has been some comment around the reliability of that assurance in terms of scrutiny of management. How can you explain to me that we're in a strong position and a more rigorous position than previously, with the changes that you've outlined already? How does that work?

Yes, of course. So, last year, the board undertook a self-assessment, as opposed to the independent external assessment that happens every three to five years—

But that's not instead of, it's additional, isn't it?

Well, we wouldn't do both in the same year, if that makes sense. We wouldn't do—

What I'm saying is that that is additional to that independent assessment later on.

Yes, we're going to have an independent one next financial year.

So, this year, there was a checklist of 52 questions that all board members answered, and they were grouped into seven focus areas, and those were: strategy and planning; performance management; capability and culture; process and structures; relationships with key stakeholders; internal control framework; and effectiveness of the chair.  

Just to give you a flavour of some of the actions we've done as a result of that, we needed to even further improve the link between our strategy and performance. So, you've seen the reworked annual plan and we're right in the middle of undertaking a review of our key performance indicators, as I said earlier. We have quite a lot, and some of them I'll stay awake at night about, but some I won't, so we've really got to get to grips with that. And also, some really difficult KPIs, like: how do we know if we're unleashing our potential? They're quite tricky.

One of the other areas that came out of the self-assessment was that the board wasn't as clear as it could be about its risk appetite. So, we've gone back and put our risk appetite around our strategic risks and, in the process, I took the board away and we fundamentally challenged the risks that were on that old risk register, and encouraged the executive leadership team to go and look at that. So, we now have an agreed strategic risk register that is considerably refreshed and looks a bit different.

The board's role with external stakeholders has been a tricky one. Adrian, as auditor general, is our outward face, and yet many of us do meet key stakeholders across Wales, and there have been tensions about what should the board's role be with stakeholders. But there's been some time invested, and in January the board is considering a revised stakeholder strategy. So, we'll have a better idea about what role we can play as a board to protect the audit independence, but actually understand how our stakeholders feel about us. 

And we also came out of this knowing that we need to continue to invest in good relationships between the ELT and the board, and between the directors team and the board. We've chosen to do that by actually working together on real issues. So, this week, we had a whole day together really thrashing out what our strategic workforce plan should be going forward, because if we're going to deliver the ambitions in the annual plan, as Adrian has hinted, we may need a different sort of workforce, different career paths, and attract different people into the organisation. So, we did some real live joint working on that, and that just deepens our relationships. 

So, those are some specifics that have come out that we're working on at the moment. 

Mark just wants to pick up briefly. Very, very briefly. 

The tensions you refer to, are those between the board and the auditor general about what the respective roles should be in dealing with stakeholders, or tensions with stakeholders because they're not happy about your assessment of that relative split? 

It's neither. It was in particular a couple of years ago, should I say. The board was very much asked not to interact with stakeholders because it could compromise the auditor general role. Adrian is far more relaxed; he knows he has, I think, a competent board, but we're going to try and codify that more specifically through the stakeholder strategy. 

Okay. Thank you. Rhianon, sorry. 

Thank you. One of the six internal reviews was rated high risk in regard to cyber security and governance around that in terms of ICT assets. So, in regard to that, that is a very, very important area, as we all know. What's happening in terms of an action around that? 

It was a really useful piece of work by internal audit. It focused very much on governance arrangements in respect of cyber security, and we've done an awful lot of work in response to their recommendations. For example, they recommended that the board received training on cyber security, and we actually in June had a three-hour training session from an ex-director at Government Communications Headquarters, which really helped us to think about what our approach to cyber security should be going forward. 

Another recommendation was that we set, as a board, a risk appetite around cyber security, which we've done. And also, they made recommendations around general training and awareness raising for staff in respect of cyber security. So, for example, since then, we've carried out spoof phishing e-mails in-house, which have really highlighted the importance of being vigilant and alert on cyber security. 

It's important to point out that these are issues around the governance of cyber security. We also wanted to look at practical measures to combat cyber security, and we've done two things in that respect. One is that we commissioned a third party of cyber security experts to come in and review our systems and procedures, and alongside that, we've also carried out a self-assessment against guidance from the National Cyber Security Centre. That's indicated that a lot of the things that we were doing anyway were pretty good, but it also highlighted some gaps in our arrangements. So, since then, we've strengthened our web and e-mail filtering; we've strengthened the guest WiFi in our offices, and also, we've moved any residual data from on-premises legacy systems into the cloud, the cloud providing advantages like better security, as well as doing so at a lower cost, and providing greater resilience.

So, when we presented the internal audit report to our audit and risk assurance committee, we did that alongside this work on the practical measures, and as a result of that, the committee concluded that we were kind of at a medium risk level overall. So, you'll see that in the governance statement of our annual report and accounts; that's where we sit on cyber security.

Just one final point is that we've outsourced our internal audit provision. One of the advantages of that is that we do get some benchmarking data from internal audit. They've carried out this similar piece of work at a vast number of organisations, and all of them have been ranked as either high or very high risk; nobody's been in that low or medium category. And I think that does reflect the very fast moving, dynamic environment around cyber security—

Sorry to interrupt you; that sounds comprehensive. What I wanted to say was that, in that regard, as you say, it doesn't stand still and it has been a risk, and I presume that's going to be an ongoing matter for you in terms of following this up in terms of the regular—

It is, and, indeed, through this estimate, we're looking for further funding for additional investment in cyber security measures.

Thank you. 

I think we're running out of time a little bit, so I want to move on to a couple of other questions.

Thank you. I'm going to move finally to this one. Two senior members of the Wales Audit Office have left through the voluntary exit scheme in the last two years. What are the objectives behind these exits, and how do you demonstrate that this is the best use of resources?

Okay. I shall answer that one. Yes, we had a VE scheme that was open to all staff, and for every single person, there has to be a rigorous business case produced, because any such exit has to align with the auditor general's workforce requirements. Those two senior staff left and have not been replaced. The annual savings from the two are £230,000 per year, and in both cases, payback was achieved in less than 16 months. It is worth saying that all our exit packages are absolutely in line with the civil service compensation scheme. 

All exits, all those business cases, are scrutinised by Adrian's executive leadership team. However, high-value exits are also scrutinised by our remuneration and HR committee, with a recommendation coming to the board for final decision. 

Okay. Thank you very much. Thank you for that. Alun.

I'm content with the answer provided. 

Okay, fine. So, we're going to move on now then to the annual plan for 2019-20, and there are a few questions on the interim report and the fee scheme as well, so it's over to Nick. 

Morning. Good to see you. As the Chair said, looking at the annual plan, and as Mark Reckless mentioned earlier—he referred to the staff survey—for the second consecutive year, you've altered performance measures, removing two that relate to your staff survey and which required significant improvement in 2018-19. Considering the poor results in the measures that were removed, do you think this is a wise move?

I need to explain how that looks, because I was worried when I looked at that. 

It looks quite bad, doesn't it? It looks like you had poor results and the measures have been removed, but I'm sure it's not that simple. 

It does look bad, but it's not that. Let me try and explain it. In our interim report, we state that we're going to have a twelfth indicator that covers employee experience, and within that there are 11 themes that we're tracking. And, actually, there are more than there are in the old annual report and accounts. So, we will be tracking organisational objectives and purpose, leadership, managing change, culture, my manager, my work, my team, inclusion, learning and development, resources and workload, pay and benefits and taking action. So, what it is is that we will be tracking as many—actually there are more—and then that will feed into the indicator under number 12. So, please be assured we are not losing sight of the granularity.

So you're replacing the old indicators, effectively, are you?

No. Eleven—sorry, there are so many reports here. In our interim report, there is an indicator number 12, which says,

'Percent positive annual staff survey thematic scores.'

And that is also referred to on page 30 of our annual plan, which shows you all the thematics that we're going to be tracking. So, I can promise you, you will have the opportunity to look at the granularity in next year's annual report and accounts.

And there's no danger that, by making that change, some information might fall down cracks between the chair? I'm talking about comparing like with like. It won't work in exactly the same way as it has in the past, will it?

It's not far off, because that's the benefit of our going with the civil service staff survey, on which the board, as well as the management team, has a full in-depth session probing all of those results, seeing exactly what they mean. You'll probably find there's about a 95 per cent correlation with the questions, year on year. Am I right there, Steve?

Yes.

Yes, it is. So, no, we don't believe we're losing sight of anything on that. And I can assure you that the board will keep that level of granularity, and it will be in the annual report and accounts.

Okay. Thanks. Your interim report notes that work is moving in line with the annual plan, and the KPIs show the majority of performance indicators are on target. Are you satisfied with that progress in year?

Well, for 2019-20, absolutely. I actually think it's down to the dedication, hard work and professionalism of the staff we've got, and, as well, the co-operation we do receive from the bodies we do audit. But I would say, looking forward to 2020-21, our agenda is still pretty ambitious. And if we're going to continue to achieve that level of performance and deliver the ambitions that we share, I would just put the case that that is why we've asked for the estimate as we have done—it is how we think we can achieve sustained performance and delivery.

Looking two years down the line, then, you're—

Next year: 2020-21.

Next year, I should say, yes. You've mentioned your relationship with the organisations that you audit, and you note that fee scales will reduce by 1 per cent in 2020-21. Will that mean lower costs for audited bodies in future, or will those costs remain pretty much the same?

Yes, but I'll hand over to Steve.

I'd say that costs for many have already been coming down. I think it's why we now receive very few responses to our fees consultation. We had nine this year: some of them were positive, and others were saying, 'Keep up the pressure on reducing fees.' The auditor general earlier talked about reducing fees by £180,000 for a number of local authorities and NHS boards as well. So, organisations will feel a reduction in their fee—not everyone, though, because fees are an equation of the skills mix that we need to put into an individual audit, the team that goes into that, the number of hours they need to work there, based on the risk profile of that individual audit. So, whilst our overall fee scales are coming down, it doesn't automatically mean a fee reduction for everyone.

Local authorities often talk about how squeezed their budgets are, and increasingly so. Do you get a lot of pressure from bodies such as local authorities to reduce fees, or, by and large, do they accept them and think they're pretty good value for money?

There is some pressure, and Adrian might want to say a few words now. There's some pressure, but, by and large, it's from the smaller national park authorities, who can look across the border to see what's happening in England as well. But when Adrian did the tour of the nation, you didn't experience that feedback to any great extent, I don't think.

No, I didn't. And I'd also say there is a trade-off here. Of course we want to deliver as efficient an audit as we possibly can, but we also don't want a Northamptonshire to occur in Wales. We do our work, and on occasion we will have to do more work because the risk profile of the organisation in question necessitates that. So it's not simply a race to push down fees at the expense of the quality of the work that we deliver.

But nine responses out of 96 consultees probably tells us something as well, doesn't it?

It tells us something. I guess it certainly tells me that our fee consultation did not send alarm bells ringing.

Yes, quite—quite. Okay. Thank you.

In your draft fee scheme, you say that your process refunds any additional charges in a way that keeps the admin costs down. Can you tell us how this reconciles with the Public Audit (Wales) Act 2013?

We probably could have just said it a bit simpler in terms of, 'We'll issue credit notes instead of cash refunds.' If a particular body does want a cash refund, we would process that instead.

But you'd rather do it through a credit system?

It's administratively simpler, in that we offset that credit against the following year's fee, and for most audited bodies, that works fine.

Unless they've got a cash flow issue and want it immediately.

In which case, we are happy to refund.

Yes, because the option is there, isn't it?

It is an option, it is, yes.

Do you get—? What would be the breakdown of that, then, between those who would go for the credit for the next year?

I don't have figures, but I'm not aware that it's a significant number at all.

I won't ask who they are. Okay, thanks.

Okay, there we are. I think that concludes our scrutiny. We've covered a lot of ground there. Thank you very, very much for your very comprehensive answers. You will, as always, be provided with a copy of the draft transcript to check for accuracy, and with that, can I thank the four of you for your attendance this morning? Diolch yn fawr iawn.

The committee will now move into private session, hopefully, because I propose, in accordance with Standing Order 17.42(vi), that the committee resolves to exclude the public from the remainder of today's meeting and also the whole of the next meeting on 13 November 2019, and, indeed, the start of the meeting on 21 November, 2019. Are all Members content?

Content.

Diolch yn fawr iawn. Okay, we'll move into private. Diolch yn fawr.