Accounts Commission Public Session - November 2025
Jo Armstrong 0:00
…via the Accounts Commission's website as soon as possible. And is available on request in the interim.
Members of the public are also welcome to observe the public session of the meeting today. Those who are watching this morning, thank you for taking the time to join us. You are here to observe and not to participate, therefore your camera and microphone are already off.
I’d particularly like to welcome the representatives from Comhairle nan Eilean Siar. Apologies for the pronunciation - I am not a Gaelic speaker, and as of today, I will continue to use Western Isles, but I welcome you all to watching us this morning. For anyone participating in the meeting who's joining us online, please keep your cameras off and your microphone on mute except when it's your item to speak.
May I also ask those who are speaking during the meeting to speak clearly and loudly for the benefit of the recording, but also the benefit of those with more reduced hearing.
That takes us to item one, formal item one, apologies for absence.

Sarah Watters 1:14
Yeah. We have apologies from Andy Cowie.

Jo Armstrong 1:19
Second item’s the declarations of connections. I know there are a couple around the table today, so can please people put it on the record?
Jennifer.

Jennifer Henderson
Item 13, the future public audit model, as a chief exec of another audited public body. But I've taken advice and I'm advised there's not a conflict of interest.
Jo Armstrong
Malcolm, Carol, you're in the same boat, yeah? Thank you. You're recorded. And Ruth?

Carol Evans
We’re… I'm a board member rather than a chief exec.
Jo Armstrong
Thank you. Ruth?

Ruth Macleod

Yes, for item 5, I have a family connection to the chief executive of Comhairle nan Eilean Siar.
And I've mentioned that to the director, who's also checked with the ethics partner, and it's not sufficiently close relationship to preclude me from taking part in the discussion.
Jo Armstrong
Any other connections?
Angela Leitch
I'm also a member of an audited body.

Jo Armstrong 2:15
OK, duly noted. And I don’t think any of those … from around the table this morning.
Thank you.
Item 3 is in order of business, as normal, I'm seeking the Commission's approval for the order of business today. I propose that we consider items 9 to 16, so 9 to 16 in private for the reasons set out on the agenda, are Members in agreement?
Takes us to item 4, minutes and matters arising from the previous meeting. Sarah.

Sarah Watters 2:48
Thanks Chair. There were two actions arising from the last meeting, both of which are covered on the agenda today. So, in the policy manager’s update, an update has been provided on pride in place funding and the methodology for the distribution of funding. And in the Controller of Audit’s update today she will provide an update on audit delivery and including in relation to Clackmannanshire Council, which members expressed ongoing concern about at the last meeting.
Jo Armstrong 3:17
Any questions or clarifications required on the minutes or can I seek approval? Content to approve.
Item 5. This is the main item this morning from our session today, which is our section 102 report on Western Isles Council.
This is a statutory section 102 report from the Controller of Audit.
And the report produced, was produced following the 23/24 audit of the council. The Commission is invited to consider and endorse the Controller’s report in this session, noting that her conclusions are not necessarily the Commission's conclusions.
The Controller and the audit team are here to provide any clarifications or answers to questions that Members may have on the Controller’s report.
We have about 50 minutes for this session. We will then consider in private later today how we wish to proceed. Handing over to Helena. Welcome.

Helena Gray 4:15
Thank you and good morning everybody and I welcome the opportunity to discuss my report on the cyber-attack at Comhairle nan Eilean Siar, and I'll apologise also for my pronunciation.
And I thank the audit team, in particular Claire and Adam who are sat alongside me this morning, for all of their hard work in completing the 23/24 annual audit.
In November 2023, the Comhairle experienced a sophisticated cyber-attack. The impact of this attack was immediate and severe. Major systems were inaccessible, and the attack resulted in the near total loss of data files held on
servers. The impact on services varied, but the most severely affected were those reliant on the council's servers, with finance being the most severely impacted.
Auditors concluded that the Council escalated the issue appropriately. The recovery was complex, and the Comhairle used interim works arounds to ensure continuity of service. In April 2025 it was confirmed that all IT systems affected by the cyber-attack were now operational, although work continues to integrate data and work through backlogs of tasks.
The financial impact of this incident has been estimated at £0.95 million, but this does not include the significant time burden placed on staff in relation to recovery efforts, which should not be underestimated.
The auditor reported that prior to the cyber-attack, the Comhairle had appropriate and effective systems of financial control and reporting. However, the attack meant that the Comhairle could not access any of its financial systems and lost a significant amount of its data.
Temporary financial control arrangements were put in place, but the loss of the financial ledger meant that revenue and capital budgeting were not possible and a complete financial picture for 23/24 was not available until after the year end.
Monitoring reports throughout 2024/25 have also been delayed. While the finance team have recreated accounting records, the attack has resulted in a loss of supporting documentation, and then as such, there is not the level of audit evidence required, resulting in a disclaimer of audit opinion.
The ledger became operational in October 2024 and the Council has focused efforts on inputting the necessary data to reconstruct the Council's financial position and rebuilding robust financial controls and ensuring data completeness and accuracy, and auditors will review these arrangements as part of the 24/25 annual audit.
The question I know the Commission will be interested in was, could this attack have been prevented? And while auditors as well as independent reviews have identified that the organisation had gaps in their cyber security, business continuity and disaster recovery arrangements it is not possible to conclude whether a more robust control environment would have prevented the attack. However, addressing these gaps may have helped to reduce its impact or improve the speed of detection and response. It's not possible to be more definitive, but I'll conclude by highlighting that my report makes a number of lessons but I think others would be worth highlighting

too, more generally in relation to IT infrastructure, preparedness and testing, staff training and IT team capacity. Thank you.
Jo Armstrong 7:28
Thanks, Helena. Helpful… how will we structure the questioning that we follow up on in this to make sure that the viewer can understand why we’ve got concerns or where we have concerns and how we're managing to pick out the right information. So, to structure the discussion, we're going to work with, work our way through a small number of subject areas covering the Council’s preparedness and response to the cyber-attack, the improvement actions taken since then and some broader lessons to learn not just for the Council but also for the sector as a whole.
We'll start therefore with questions around the governance and risk management and ask Jennifer to lead off the question.

Jennifer Henderson 8:05
Thank you, chair. Thank you Helena and team for the report. I think it's very clear from reading the report a lot of hard work has gone in to recover from the attack, but I'd really like to go back to the sort of what we know about what was in place before this happened.
You said in your opening remarks, Helena, it's not possible to conclude whether this could be avoided, but I suppose I'm interested in exploring a little bit about what governance was in place for the Council to understand how vulnerable they might have been.
So, I've got a few areas to explore. I'll run through them all and then you can obviously kind of think about how you want to respond. So, I'm firstly interested in whether we know whether ownership and responsibilities for cyber security were clear, and I'm not talking about at the level of IT professionals I'm talking about in terms of the leadership in the Council. Were people clear that they were responsible? And then I'm interested whether we know that the people in those positions had had adequate training to discharge those responsibilities.
I'm interested in whether the Council had set a risk appetite for its cyber risk, because it's very easy to think all you need to do is keep spending money on this problem.
But it could be an infinite amount of money, and you have to have a risk appetite in order to inform decisions. And if they did have a risk appetite, have we got evidence that that was applied around their IT infrastructure and cyber security?
And then in the context of all of that, I'm interested in the monitoring and reporting. How were senior people in the Council aware of the level of risk they were carrying? Were they aware that there were gaps in the kind of IT resourcing and things like that?
So it's all of that really around, under the heading of sort of governance around the cyber risks. And then I've got a couple of questions about and what's happening to rectify the gaps if we do understand that there are gaps?
Is that clear?

Helena Gray 9:59
OK. Thank you. And there’s as you said a lot in there and I'll kick off and then I'll bring in the team to add some of the, add some of the detail.
I think a couple of things that I'd highlight. So, auditors have reported in 2022/2023 that there was no clear responsibility at committee level for oversight of IT risk.
However, those charged with governance were cited on the high level cyber security risks via the operational risk register, which is presented to the Policy and Resources Committee.
I don't think we're aware of any members receiving specific training on cyber security prior to the cyber-attack.
But again, I suppose not aware, might not mean that it's, that it's not happened. In terms of the specifics around the risk appetite, again not aware that that was something that was explicitly discussed or applied to decisions around IT infrastructure and cyber security.
But I would observe that auditors have highlighted for a number of years, risks associated with incomplete business continuity plans.
So as far back as 2016/17, the annual audit highlighted that the IT unit business continuity plan was still to be completed and that the systems and supporting protocols required as part of the disaster recovery plan had not been addressed. At the time the action was agreed by the Council with an implementation date of March 2018, but subsequent audits then highlighted that that was incomplete and still ongoing.
So, on that basis, I'd infer that it possibly wasn't seen as a priority when compared with other Council priorities.
But I'll bring in the team to talk a little bit more, perhaps about the different risk registers that Council has and how they were scrutinised..
Claire Gardiner
Yeah, so the, as Helena has pointed out, the operational risk register is where they monitored the cyber security risk at the formal governance level, so through the Policy and Resources Committee, however, it should be noted that this was at a strategic level and didn't get down into the detail. A more detailed risk register was maintained by the asset and infrastructure sector and this covered the detail of IT and cyber security risks and included several levels… labelled as high or extreme risks. However, we flagged in our report that the risk register lacked key information such as responsible officers and time scales for redress and the proposed solutions. This detailed risk register was not considered by any designated governance committee, and we concluded that there was no, no clear Committee responsibility for IT risks.
Moving on to a bit about what's happened since then. Since then, the, since the cyber-attack, the actions to address the cyber security, recommendations are now monitored by the Audit and Scrutiny Committee, and this has started to be reported

at every meeting. However, it's now moved to alternate meetings as some of the actions have been addressed and they feel that the risk has significantly lowered.
Jennifer Henderson
It's really helpful and you've come straight into the kind of about what's happening, because I've picked up from your report, Helena, that there was some suggestion that not all recommendations have been fully implemented and there were some gaps which gave me calls for concern, I suppose, because, from what I'm hearing, it sounds like there wasn't as much governance around the cyber security risk as there could have been prior to the attack, but I would certainly be hoping that that is being made rock solid the other side. So, I think it would be something we'd want to continue to look at, the follow up to the recommendations. So no, thank you, Jo. I think that covers the things I wanted to ask about in relation to governance.

Jo Armstrong
Any follow-up from Mike or Derek?
Derek Yule 14:00
Yeah, if I, if I could, chair. Thank you. Thanks very much for, for the report.
My particular question on this really relates to paragraph 24 of the report, it says to return to an unqualified opinion, that will, you'll require evidence of sustained progress on financial governance and also system resilience. You know, I wonder if I could tease that out a bit more to what that would entail.
So at a very simplistic level.
You issued the opinion on the 23/24 accounts, on the basis of a lack of evidence, now that must impact on the closing bal… the opening balances for 24/25. So, I'm wondering how you move away from that whilst the Council is reinstating its systems going forward.
How do you overcome the initial balances that will form part of those the following year’s, year’s accounts? So I wonder, could you answer that specific point and then also what financial governance and systems resilience will need to look like or get to before you can get back to an unqualified opinion.

Helena Gray 15:07
I’ll bring in the team to answer that very specific point. I suppose a couple of things that I wanted to highlight as well.
So, as I've already mentioned, the loss of that detailed accounting record has meant the auditors weren't able to obtain that sufficient audit evidence. I do think it is important to highlight that in the annual audit report, auditors commend management on their ability to prepare a draft set of financial statements and highlight that the issues which impacted their audit opinion were reflective of the underlying loss of financial information rather than the response by management in preparing the financial statements or providing evidence - just important to put that

on the record. But bring in Claire to talk a little bit more about the specifics of the opinion.
Claire Gardiner
Yeah. So, the finance system was implemented in October 2024 and the, as Helena outlined, the finance team has done a lot of work to reinstate those financial controls and rebuild the ledger. However, there is the implicate… the indication that the first seven months of 24/25 were still being maintained and recorded using spreadsheets. Although that information has now been put on to the ledger, there are issues with the manual controls processes which mean the financial governance around the first seven months of the year were significantly weaker.
When we're thinking about our opinion, we're really thinking about how we can get assurance over the in-year transactions and the closing balance, we recognise there will be issues with the opening balances and we're preparing for a modified opinion in 24/25 as well.
So we will, we will be seeking to get more assurance on the closing balances in year, which will then give us enough assurance to support our 25/26 position. I think it's important to note that there were gaps in the data coming into 24/25 and the finance team have done that additional work to close those gaps.
So even though we won't get full assurance over the opening balances, we're assured and cautiously optimistic that we'll be in a better position than we were when we signed the accounts anyway.
Derek Yule
OK, that's helpful. Thanks.

Jo Armstrong
Let me just follow up on that, Claire.
Does that mean it's permanently got a modified opinion?
Given 24/25 leads into 25/26 so does 25/26 lead into a modified opinion for next year?

Claire Gardiner
No. So as I said, we'll be focusing on the closing balances of 25/26 and if we can get enough assurance over that, then that means the 25/26 accounts don't have the same issues with opening balances. But from looking at the situation down south, there's an estimation that at least, post disclaimer opinion, it will be a minimum of two years to get back to a sort of unqualified opinion, and that's what we're looking at. We're hopeful, but not promised, that we'll be looking at it for the 26/27 accounts. We'll consider as much as we can.
Jo Armstrong
Mike, did you have anything you want to?

Mike Neilson 18:16 Really just on the…
First to say I'm recognising like others, the enormous efforts that the Council and its staff have gone to and that will be discussed later.
Just in terms of the relationship between the IT function and, as it were, the governance, looking as of now would it appear that that there was a disjunct really, in what the internal audit report was suggesting in that … was adequate given the resources, but there was no, there didn’t seem to be a process for actually getting the risk appetite in place, so I suppose the question comes down to is, it now clear that there is a risk appetite in place and that there is proper ownership of somebody in the senior team as well as the IT manager for the remaining risks.

Helena Gray 19:18
So I think in terms of the specifics, as Claire has already outlined in terms of the response, so the Audit and Scrutiny Committee is now leading on the follow up and the implementation of the of the audit report and the recommendations. And they started using monthly and I think I've moved, I think you said, to every other month. Alternately.
So in terms of the risk appetite, I'm not sure if we've got the got the information on that. I think the other thing just to highlight is that in September, the Audit and Scrutiny Committee considered a further independent review on cyber resilience that was undertaken by Glasgow internal audit and that report highlighted that progress had been made as well. So I think hopefully that… it concluded that a reasonable level of assurance can be placed upon the control environment and that the key controls are in place and operating effectively. They make one high priority recommendation and then … priority recommendations which management have accepted and is progressing. So hopefully that gives that assurance now in terms of their consideration of the control environment which they are operating.
Claire I don’t know if you've anything?

Claire Gardiner
Specifically on the point of risk, we had raised the recommendation around improving the risk management processes in our 22/23 report. And when we followed that up this year, it was only partially implemented.
So each risk now has a recommended responsible officer, but there are still not timelines and the risks remain high level. So I think there is still some work for Comhairle to do improving the risk process.

Jo Armstrong
Moving on then to preparedness which neatly follows from there. Malcolm, can I ask you to pick up?

Malcolm Bell 21:20
Yeah. Thank you, Chair, and others have said thank you for the report.
Helena you touched on this in your opening remarks, but I just wondered if you might be able to expand a bit and it's the part in the report that states that control weaknesses…
Even if the control weaknesses had been addressed, it might not have prevented the attack. I think that's quite, quite sobering, and I just wonder how we how we encourage councils to apply resources from in effect of saying even if you have very strong control measures, you know, this might not prevent an attack. So is it, is it about mitigating the effects of an attack, is it more about that?
And the other thing I was slightly surprised about and as a non, non-IT person was that the independent investigation couldn’t find any indicators of compromise. I So I just wondered, is, is that unusual or is that just something that we wouldn't expect to find, normally?

Helena Gray 22:27
Thank you. And again, I'll offer a few remarks and then bring the team in a little bit more detail.
I suppose just that conclusion around control weaknesses as said in my opening remarks, it's just difficult to be definitive on that. But the auditor and the independent review had identified the organisation had gaps in their cyber security. But as you've also highlighted, crucially, their business continuity and their disaster recovery arrangements as well. And while internal audit concluded that there were clear weaknesses, the system in place was considered adequate at the time.
I think it's also important to note that you know, organisations with more robust cyber secure… security arrangements have also been been victims of cyber-attacks, so it's just not possible to be definitive. But I think as you've highlighted, there are absolutely lessons to be learned around recovery as well, and my report highlights that disaster recovery exercises prior were completed on an ad hoc basis and the cyber incident response plan and disaster recovery plan had not been finalised and approved by members and we know that the Comhairle used, had a corporate business continuity plan that was approved prior to the attack, but the application of that was inconsistent and it was not sort of considered at the scale of the attack. So again, I think there are definitely lessons to learn there.
In terms of that specific question around indicators of compromise. My understanding is that it's not uncommon for no indicators of compromise to be detected.
Andrew Burns 24:15
Thanks Jo. Thanks, Helena and colleagues for the report. I wonder if I could just follow up on Malcolm's question about the general sort of readiness, So I hear it loud and clear what you've said Helena and you've repeated it to Malcolm that you know the weaknesses that are identified, I think it’s in paragraphs 55-58, you can't be

certain that even if they've been addressed, that the attack wouldn’t have happened. And I see reading through the report that those weaknesses identified in those paragraphs feed directly into the conclusions, which is what you'd expect.
I wonder if I could just probe a little bit further on sort of staff capacity. I mean the figure that jumped out at me when I read this, and I absolutely get this is probably particular to the Western Isles and its locality and rurality, the 30% vacancy in IT officers, including some of the senior systems analysts.
You can't say even on that statistic that that had a direct impact on potential disruption that was caused by the attack? And I just wonder if you could give us any further update in addition to responding to that point, because it does seem specific, very high to me.
Although the, I know the global number’s low compared to say Edinburgh or Glasgow, but how is that position now today?
Has it improved and is there an indication that it's going to continue like that? And I've got a follow up from the back of that. Thanks.
Helena Gray 25:38
So. So on the on the specific trigger, I'm not sure we can be definitive as to whether having filled those vacancies, it would have been in a better position.
But what we do know is that there were 30% of positions were vacant, which did have a, I suppose an impact on the on the disaster recovery and cyber resilience plans and activities. Four of those five vacant posts have now been filled.
And applicants are in post and the one remaining post is being progressed.

Andrew Burns
That that's… Thanks Jo, thanks Helena. That's, that’s as of today. So there's just one vacancy in effect.
Helena Gray
I believe that that's the case.

Claire Gardiner
That was certainly the position when we signed the accounts in, which was in September.
Andrew Burns
I guess just the other general point that it flags up to me and it makes really just by way of comment, I don’t know if you want to respond to it or not is… I mean obviously it's all internal the IT provision that's happening here in Western Isles and continues to be so as far as I can gather. I mean that’s I think increasingly not the common picture now across all 32 authorities, particularly the larger local authorities in Scotland. I just wondered if there'd been any discussion or debate in the Western Isles about outsourcing this provision.

And it’s really just by way of a query. I just was inquisitive to know if that had happened or not.
Helena Gray
Yeah, I'm not sure on the specifics of that.

Claire Gardiner
Not that I'm aware of.
Andrew Burns
OK. Thanks very much.

Jo Armstrong
Malcolm, did you have any follow-up?

Malcolm Bell
No.
I'm just concerned about, you know, the message that we're saying that, you know, even organisations that have really strong, and I don't doubt it's true, but really strong measures in place can be victims of such attacks. I just wonder how we can encourage, you know, the message we can give here today, how we’re encouraging councils to invest in, if in actual fact they could get an attack anyway. I guess it's more about the mitigating, afterwards…

Helena Gray
So I think I think the message would be ensure your systems are as robust as they can be at that particular time in line with guidance. I'm not an IT expert, but it would be, you know, ensure that you are following the IT guidance and doing what you can to mitigate the likelihood of an attack.
But also invest in that preparedness, knowing that cyber security is an, you know, ever changing, ever increasing risk, that that many organisations are facing.
And so it's also about investing in that preparedness for recovery and resilience as well.

Mike Neilson 28:34
Just one really specific point.
The system, the backup system is not air-gapped. i.e. isolated from the main system. Is it accurate to think that that made the process of recovery more difficult because basically had no data left.
And is there a reason why, I think in the report says that the air gap, air-gapping is not yet in place.

Helena Gray
Yeah, I'll bring in Claire to talk specifically around the arrangements for the backups and the air gap.
Claire Gardiner
Yeah so I think undoubtedly the fact that it wasn't air-gapped did lead to the backups being targeted by the cyber-attack as well.
The reason for it not currently being air-gapped is they're looking for additional funding to support the costs of air-gapping the backups. The decision for that was to be made in September this year so basically, budget allocation moved to support the air gap.
I'm not aware of what happened at those discussions. That that was the reason for the slight delay. It was just to move funding.

Jo Armstrong
Can I pick up on that, Claire? You're telling me that Council does not believe that proper cyber security measures are not a priority for the budget allocation?

Claire Gardiner
No, I don't think it's that they don't believe that they're not a priority. It's more that they just needed to have that discussion formally.
Jo Armstrong
But they’ve had to spend money to back up, to recreate.
So they’re currently spending money they didn't budget for and didn't need to budget for had they done it properly. So the notion that they can do these things ahead of a sign-off for something as serious as this, they are not thinking that's essential now given what they've experienced?
Claire Gardiner
As I say I'm not aware of the outcome of that discussion, but I know it was up for discussion in September and that was the last piece of the puzzle to confirm all those.

Ruth Macleod 30:49
Just wanted to ask a bit more about business continuity planning and it’s good that there was kind of business continuity plans in place, but they were used quite inconsistently across the departments. And I was struck by the comment about the fact that it looked like they were kind of almost set aside in some cases because business continuity plans, they said didn't kind of match the scale of the incident that they were kind of presented with, and that seemed to be to be quite a strange thing because surely the whole point of business continuity plans is to over things like catastrophic events such as these.

So I just wonder if there's been some progress made around ensuring that these business continuity plans will work effectively in the future and will be applied appropriately across the departments. Again, I just thought it was strange that they seem to not have been used in the way that you might think was intended.
Helena Gray 31:44
Absolutely, and again I’ll bring Claire in to offer the latest position on the business continuity plan. I think as I said, it was approved, but it was inconsistently applied because it exceeded the anticipated scenario, but they did use it as a useful framework I think was the basis. I think the other thing as well obviously is is around the testing of business continuity plans and ensuring that they are tested so that you can test the scenarios and then see in fact how you would use them or whether they are useful, but Claire, do you want to come in and say the latest position on the plans?

Claire Gardiner
Yeah. So the business continuity plan was originally approved in June 2023 and was then updated in 2024 following the cyber-attack. From review of the plan, some of the issues that were raised as part of the lessons learned haven't been addressed, however, revised business continuity plan was done for the business, the lessons learned activity, so I would suggest that they do need to go back and look at all the lessons learned.
Jo Armstrong
Takes us on I think to next session which is on the impact this has had on services and staff and the financial impacts. Can I ask Ruth, are you wanting to lead off on that too?
Ruth Macleod 33:06
Thank you. Again, just worth saying obviously I recognise as I'm sure other Commission members do, the huge impact this has had on staff and it's very clear that you know, there was a very quick response, but it's also been a very sustained period of time that staff had to respond. I just wondered if you could say a bit more about the impact of both the initial attack and then the recovery stage on staff workloads and morale?
We know that there were gaps in some of the teams like IT, I don't know what the resilience levels were in finance and the comms department, who in particular I think would be very hit by the immediate actions that needed to be taken.
Just wondering how the Council is responding to looking at the kind of longer term impact for staff dealing with the day-to-day job, also all the extra work that's come from this?

Helena Gray 33:59

And a couple of things that I'll say by opening remarks. So obviously flagged a number on a number of occasions throughout the report the impact on staff. As you've already mentioned, the increase in work volume as a result of having to use manual processes.
And you know the pressure, I think that that comes with this as well. I think I would highlight that as I set out in the exhibit in my report, not all services were equally affected. So I think it is worth bearing that in mind when we're thinking about the impacts on staff.
There hasn't been a formal assessment on the impact of the cyber-attack on staff well-being, but they did conduct an employee survey in November.
The return rate for that was about 35%, which as we know is, seems low but is comparable to wider employee surveys. And the results of that were presented in April this year to the Policy and Resources Committee.
And demonstrated a fairly stable picture, I think in terms of satisfaction. But I'll bring in the audit team to talk a little bit more, I suppose about some of their interactions with staff.
I think the final thing I’d draw attention to is the data on sickness absence actually. And looking at the local government benchmark framework, if you look at the sickness absence days per employee for the non-teacher statistics, it shows that in 24/25 the Council is below the Scottish average. And although it did rise in 23/24 compared to the prior year, it has since come down, so obviously we use that sometimes as a as a proxy as well.
But Claire, do you want to come in and talk a little bit, I suppose about your interactions with the with the staff as well and your sense from that?.

Claire Gardiner
Yeah. So the evidence we have on the staff morale is mainly anecdotal. And as Helena has already outlined, it varied across different departments, but our key interactions are with the finance department, who was one of the worst impacted teams.
So we are aware that after the cyber-attack, there was a lot of pressure on staff and staff morale was quite low, as they tried to rebuild the system.
We're hopeful that things are now improving. There is a new financial ledger in place. The finance team did a wonderful job getting the 24/25 accounts prepared on time. So we got them by the June deadline. Unfortunately, because we were still catching up with the prior year audit, we've not managed to do that, but we are kicking off the audit next week. We've got planning meetings in so we're hopeful that things have now turned a corner and the impact of the cyber-attack has diminished, recognising that there is still work ongoing.

Jo Armstrong
Any other questions under that section, Christine.
Christine Lester 36:49
Can I maybe just pick up on Ruth mentioned comms and you came back with finance, the effect on finance.
I was going to say later on that actually one of the things that you commented on was that external comms were good, internal less so. So coming back to the staff well-being etcetera, has something been done about that now because as part of the disaster recovery process?
Helena Gray
Thank you. Yeah, Claire you want to come in on specifics around how the work around the business continuity plan has taken into account the suggestions on internal comms.
Claire Gardiner
Yeah, I think that I'd said that the business continuity plan comms strategy hasn't actually been updated since the lessons learned exercise so that will need to be reviewed.
I'm not sure I have much else that I can add on the comms….

Christine Lester
In terms of the comms team, is it, was it fully, was it, was it, were there any gaps there? Were there any vacancies at the time?

Claire Gardiner
I don't have that information. I'm not sure.

Christine Lester
I was just coming back to that, that, that general sort of. Thank you.

Jo Armstrong
Derek.
Derek Yule 38:03
Yeah. Thanks, chair. I'm delighted to hear you say that they they've managed to complete the 24/25 accounts on time. That's a tremendous achievement, at any time, it’s not simple. But it beggars belief what the staff have gone through to get to this stage because my gut feeling is you can't always test some of these things to actually put in a sort of manual process. So it'll be interesting to eventually hear a sort of lessons learned, how they went about it and sure other councils can learn.

Because I think it's one of these key things you don't you can only think so far ahead to the worst case scenario, but when your worst case scenario is a lot worse than, the reality, how you can actually test some of these things in practice.
Specific question was moving away from the impact on the Council itself to understanding the impact on the wider community.
I think in particular about suppliers, contractors and maybe equal or more importantly, assort of welfare payments, etcetera. So I'd be interested if there's any information. I know there was, there's information in your report to how the Council went about the process and how it worked with DWP etcetera. I just wonder if there's any, whether it’s anecdotal evidence or what of what the impact was on the wider community of potentially delays in payments or people not being able to get welfare benefits that they were entitled …titled to, so not so much the financial cost, but the cost in terms of that wider aspect.

Helena Gray 39:34
I’ll bring, I’ll bring the team in on that. But I think in terms of the benefit payments, I think the Council recognised that delays in benefit payments could have seriously affected some of their most vulnerable residents. So they worked with the Department for Work and Pensions to manually recreate, recreate the payments.
And those payments were based on previous records. Now obviously that comes with a with a risk for council in terms of overpayments.
And obviously risks around fraud and error as well in relation to that, but I think these are the risks that the Council chose to take in in that case.

Derek Yule
How supportive were the DWP?

Helena Gray
I don't know if we've got information on that. I don't know if you'd be able to.

Claire Gardiner
I don't have enough information to be able to comment fully.

Derek Yule
Thank you.
Jo Armstrong
Angela.

Angela Leitch 40:28 Thank you.
So, I think the report’s great and the Council is to be commended in restricting its additional expenditure on recovery to just under £1,000,000. I know it's still a lot of

money, but I do think it could have been significantly higher given the systems that were affected.
I do wonder, you know, finance aside, what were the what's the impact been on performance across services?
So they would have had published plans, the annual plans and longer term plans, is it possible to say how the diverting staff onto recovery has then impacted on the ambitions or the kinds of the goals that they have set, initially before this happened?

Helena Gray 41:19
Yeah, so performance reporting was impacted by the cyber-attack.
So quarterly reporting was not available. But the Comhairle presented its public performance report for 23/24 to in the Audit and Scrutiny Committee on the 1st of May of this year.
Overall, the service performance information that was reported by the Council demonstrates that performance compared to prior years and against other councils has remained relatively stable during this time.
The most recently published information on service performance reported on the Council's website and their annual performance report highlights that o the 94 LGBF indicators, local government benchmarking framework indicators reported by the Council, 63% have improved since base year, 9% have remained the same and 28% have worsened.
If we look at changes against the most recent year, 36% of performance indicators have improved, 26% has stayed the same and 38% have declined. So whilst overall reporting has been disrupted by the cyber-attacks, so it's obviously difficult to conclude definitively and we obviously don't know what that counterfactual might have looked like that we'd be comparing against it. I'd say overall, it doesn't look like there has been a marked shift in service performance as a result.
Which I think is probably testament to the efforts of the staff involved.
I do think it's important to remember, and I keep coming back to this, obviously not all services were as affected as others. So health and education services were less affected, as already outlined in my report as well.

Angela Leitch 43:02
It's encouraging. Thank you. Can I just ask one other question on this while we're talking about staff? One of the outstanding actions that you talk about, paragraph 63 is full implementation of the staff training programme.
Is that progressing now?

Helena Gray
Yes, it is. So the staff training programme is progressing and Claire might want to say a little bit about the exact statistics of how many have gone through it. I don't think it is being formally reported in terms of take up, but I think it is being informally

managed by, by lead officers and I think there is a plan to articulate when the refresher training is required by as well. But Claire, you might have the specifics.
Claire Gardiner
Yeah. So at September, 67% of staff had undertaken the training and the ongoing action was round about how they chase up the people who haven’t done the training and formalising that refresher training programme. So that's why the action is only partially implemented, because they haven't got those formal arrangements around chasing and refreshers.

Angela Leitch
Thank you.

Jo Armstrong
No senior people involved, who've not had their training?
Claire Gardiner
Unfortunately, I don't have the detail beyond the 67%. Jo Armstrong
But that's a clear request to understand the extent to which senior people are taking this seriously. The extent that they're following through on the significant training requirements needed.
Any other questions on this section? Nichola.
Nichola Brown 44:44
Could I just follow up briefly on some of the questioning that that Ruth gave at the beginning of this section?
I think we've heard and we can glean from the report that the staff have made a tremendous, sustained effort in order to mitigate the impact of the cyber-attack. And the what you've informed us about around the absence rates is somewhat remarkable, I think.
I just wonder whether and appreciating that the impact wasn't felt across all of the departments, but for those teams who were in particular affected.
Has there been any investment in resources to provide support to staff in terms of their well-being, and is that something we have any evidence around?
Helena Gray
I'm not sure we have the specifics on that, I'm afraid. That's not to say that there hasn't been and that's not to say that there aren't already, you know, support in place anyway. I’m just afraid that we don’t have the specifics.

Nichola Brown
OK, thank you.

Jo Armstrong
That takes us to our last two sections, ones around improvement actions, and then Carol you want to lead off on that.
Carol Evans 45:56
You've partly answered my question, which was around the follow-up training. But given the fact that cyber-attacks are usually 90%...
A human has had a contributory factor to it. And the fact that we're only now starting to monitor the training and you're saying the actions are now only now in place for the refresher training. Do you know the reasons for why that wasn't prioritised sooner and why, why that was one that's outstanding given the high human nature of cyber-attacks?

Helena Gray 46:33
I'm afraid I can't comment on why it wasn't prioritised before.
I suppose I’d just note as Claire has already said that that that training is underway. I think it is also important to emphasise that while the cyber-attackers gained entry via an employee's account, we don't know how they how they did that. So I think it is important to I suppose to be as clear that we don't know that human error was, you know, that we don't know that there was an employee error there that that enabled the cyber-attackers to gain access to the account.
As I said earlier, no indicators of compromise were identified, and that's not unusual. So I think once we rightly put that emphasis on that staff training, I wouldn't want that to be taken away that that was the…

Carol Evans
And on that it did say that the attack took between, took place between 3 and 5 in the morning.
Have they ruled out that an employee wasn't working then at that time on a computer?
Helena Gray
As I say, I think the fact that they haven't found any indicators of compromise in that regard means that I think that that doesn’t appear to have been a factor.
Jo Armstrong
Any other questions under improvement? Nichola? Malcolm?
Malcolm.

Malcolm Bell
Yeah. Thanks, chair. Just quickly, I noticed one of the priorities in the recovery phase

was building back better, it was a phrase which was used just a few times in your reports.
I just wondered if you can say anything about that, what would that look like, once it concludes?
Are there any trade-offs involved in how to achieve that?

Helena Gray
I think at its essence, it's about building cyber resilience into the into the systems. I think in terms of the trade-offs or the or the funding around that, I think of the 0.95 million, 0.3 million of that is as part of that sort of ongoing, I suppose building back better cost. But Claire I don't know do you want to say what that has, what you've seen that mean in practice I suppose from a financial perspective?

Claire Gardiner
Yeah. So, while the internal audit note, report noted that they're unlikely to get the best systems and the best the market has to offer because of budgetary constraints, they are working to find some improvement. So just for example, with the financial ledger they have purchased a new financial ledger, which is cloud based and is the version ahead of what they were currently using. So it's a lot of little things.

Jo Armstrong
That needs again also takes into sort of lessons learned. Angela if you want to lead off on that.

Angela Leitch 49:21
Thank you. So I think as we’ve said the Council has done remarkably well to keep services going and deal with such a traumatic incident taking place.
Their experience will be of value to others. I'm just wondering whether you know how they’ve documented what they did and how they might be sharing that both with other councils but wider.
Helena Gray 49:46
Yes. So I suppose we're not aware of any formal processes for sharing lessons learned from the cyber-attack with other councils or other public bodies, but I would say that throughout, I think they have been engaging with the Scottish Government, the National Cyber Security Centre and the Cyber and Fraud Centre, all of whom have roles and responsibilities in in supporting organisations more widely, and I'd hope that that through that there is a wide gathering of lessons learned, but I'm not aware of anything more formally that's taken place.

Jo Armstrong
There's no one in Scottish Government or Improvement Service gathering it and
helping…?
Helena Gray
It's probably the wrong person to ask that question to, I think, but I'm not, I’m not aware of anything. It’s certainly not something that's come across our desk, but that's not to say again it isn’t happening in other…
Angela Leitch
It's maybe something that we should pick up on because I do think that, you know, harrowing as it might have been, it could avoid similar situations arising elsewhere.

Andrew Burns
Just briefly following up on Angela’s point, presumably, Helena, the very existence of your section 102 report provides an opportunity to more widely publicise. I think Angela’s right and we’ll speak about that in private session probably but I hope you would agree it provides an opportunity to more widely publicise what happened and what actions Western Isles took to recover from the problems.

Helena Gray
Exactly. And as you know, the purpose of a section 102 report can be about, you know, that wider public awareness, wider public interest story on reporting these things. And as I have set out in my report, I think there are lessons to learn and I'm very happy to have a discussion with the Commission about how best to support the dissemination of those messages.

Jo Armstrong
Any other questions on lessons learned, Mike and then Derek?

Mike Neilson 51:43
I suppose mine was a was very much on the broader question in that in that while it's not possible to say that that implementing the audit recommendations will have prevented this.
It's… It seems that one of the one of the wise things to do would be to implement audit recommendations around cyber security, and I suppose.
What picture do you have of the extent to which there are recommendations in this area that are happening in other local authorities and not being…

Helena Gray 52:24
Absolutely. As I highlight in paragraph 64 audit recommendations are, are made to help improve governance arrangements and help public bodies safeguard their assets. And it's important, I think, one of the things that we've seen in this is that, it's

important that when recommendations are accepted that timelines are set, responsible officers are outlined and that those timelines are realistic and achievable as well. And that just helps ensure that clear accountability for delivery and enables effective monitoring of progress.
And from our review, we've obviously highlighted that that's one of the areas that we've been encouraging the Council to take forward.
More generally, I think as you've highlighted, this is an area I think Audit Scotland is focusing more of our time on in terms of looking at the extent to which our recommendations are implemented.
We know that vast majority of them are accepted and implemented, and obviously it is a management decision as to whether to accept audit recommendations, but I think this is something that we will come back to as well in terms of that that follow up in more detail.

Derek Yule 53:44
Yeah, thanks, chair. I mean, I think my question was probably maybe been partly been covered but it’s maybe on that broader picture as well, but lessons learned. One of the questions I had from your report, which seemed to suggest that cloud based systems offered a greater level of protection.
It was interesting you said Claire that they then introduced a new financial system which was cloud based. So I wonder that was one question I had in mind whether that was something we should look at as a formal recommendation that… Councils more generally, not just the Comhairle that should be looking at cloud
based systems to offer a degree of protection. And I guess the other points, I mean we are kind of pushing how we’re looking for councils to share services or work collaboratively, and I do wonder whether that potentially opens up a greater risk or not, and I'm not sure whether that is the case, but it's a question I’m mulling over just now. So that's maybe wider than just this but as part of the lessons learned.
It's got me thinking in my own head well actually what can you do in terms of prevention and does it expose individual councils to a greater risk if they if they work more collaboratively?

Helena Gray 54:57
So I'll bring in the team to talk specifically about, I suppose the Comhairle’s experience with their education in schools and that network in, in terms of their shared services.
I think to take your first question around cloud based technology, and I'm obviously not an IT expert and so I don't think I'd want to make a recommendation in that space on what IT systems should or shouldn't be used. I think that is way beyond my remit. But I suppose I would observe that in this instance, I think as we have, the cloud based platform experienced minimal disruption to core services. But they were still affected by the loss of data that was stored on servers and a temporary

breakdown in communications. But a different attack might have yielded different results.
I also don't know what the state of play across local authorities is in terms of the adoption of cloud based technology and just what a what scale of ask that might be, but as I say, I think that that's a question for digital and cyber security experts in this case. We just, I suppose, limited ourselves to the recommendation that organisations should review their infrastructure to ensure it is resilient and meets recognised disaster recovery standards, and I think at this point, I personally couldn't go further than that.
But Claire, do you want to just come back to that shared services point and the experience with the schools network?
Claire Gardiner
Yeah. Again, I'm not an IT expert and I don't really have the experience to comment on how likely that risk is, but our experience with the Comhairle was in the early stages of the cyber-attack they acted quite quickly to advise staff not to access the SEEMIS system and to close off the SEEMIS system due to the risk that it might spread throughout the education network across Scotland. So clearly that was a risk they took into consideration and acted appropriately for that.

Jo Armstrong 56:58
Yes lessons learned are certainly something we will want to be pondering a bit more in our private session, but is there any other questions in this public… that you want to say?
No, I think we've had a good, good run at it. And yes, there's, there's commendations and also concerns in equal measure, I think, so thank you. Thank you. And for your input today.
That then takes us to item 6, local government policy update and that’ll be Joe.
Joe Chapman 57:32 Thanks very much, chair.
As usual, happy to put the emphasis on answering questions from Members, but a couple of updates since the report was produced. Members might be aware of some rumours around the UK budget in three weeks’ time and what might happen in terms of taxation, which could potentially have an impact on the on the Scottish budget, which might then feed through into the funding available to local government, but you know, a lot still to happen in that space, so we will keep, I'll keep an eye on that. In terms of the Scottish budget itself, the Bill timetable itself has been published, which really just demonstrates the kind of compressed time scale that all of that is going to happen in the in the new year. It's a six week period from the announcement of the budget to the budget bill due to be passed at stage 3.
Meanwhile, Shona Robison has also written to the Local Government Committee regarding the general power of competence.

She has pointed out that the consultation provided no definitive preference regarding that and says there's no certainty that a general power will actually deliver the flexibilities that Councils are potentially looking for, and is proposing taking a number of interim measures in place of a sort of Big Bang kind of approach and there's a couple that have been set out in her letter around widening the definition of the power to advance well-being in the 2003 Local Government in Scotland Act. It's not set out yet exactly how that would be done, so again, another, another aspect that I will keep an eye on, but yeah, happy to answer any questions. Thanks.
Jo Armstrong
So any questions for Joe? ...

Carol Evans 59:13
I've got an operational question and it's on the engagement and links. It's just to what extent do we know they are real people as opposed to for some of the engagements, bots? And has that been considered?
Joe Chapman
I'm sorry, Carol. What's that in relation to?

Carol Evans
In terms of the engagements where it's just a view, how much do we know that they're real people as opposed to bots, because increasingly what were found in some areas is it's bot views and not real views.

Joe Chapman
On the Commission reports?
Carol Evans
On Commission reports.

Joe Chapman 59:46
Yes, yes. So you'll see that actually as, partly as a result of that issue is the reason why I'm no longer doing the quarterly figures because I've been in contact with the communications team and they've kind of given that warning about the reliability of those figures.
What we can say is that that activity tends to happen over a period of time, so the kind of immediate activity and immediate download numbers and more reliable. So where I put figures for downloads of reports for recently published reports, they’re still reasonably reliable.
And in terms of social media engagement, again similarly, I guess there is an element that some of that might be kind of automated activity but unlikely that that would

happen in the sort of first 24/48 hours. So the information that Members get from the communications team and from myself in these reports should still stack up, and I think that the general trends that we see in terms of comparisons, if a particular report has had more or less engagement. Again, that kind of general picture is still representative of reality, if you like.

Carol Evans
Follow up to that.
With AI becoming more sophisticated at scraping data, are we finding that people are using AI to get the information on the audit reports and not coming to source documents? Or are we still getting people coming to our source first.

Joe Chapman
It's difficult to tell.
But the figures that we have in terms of the activity that we have on our website would be people coming to our website. So it may be that the report is also then being distributed via you know second, third, fourth parties if you like.
But we wouldn't get the figures from that. So again, it's, it's that thing of, it's definitely something that we're bearing in mind…

Carol Evans
Where we’re getting less clicks. It might be that AI scraped it.
Joe Chapman
Yes. I think there's an element of kind of a cycle there as well where if that does happen, that's likely to generate more activity that people might then click through to maybe other Commission reports or Commission website, Commission social media, etcetera. So actually that that might actually help broaden the reach of reports as well in a in a way but with that caveat around then the numbers that we see and how reliable they are.

Derek Yule 1:01:58
Thanks. A couple of questions. The first question, you mentioned the contracted time scale for the local government settlement. Is that just going to one year figure, are they still going to go ahead with three years as was indicated earlier? Do we have any idea?

Joe Chapman 1:02:14
Recent comments from the Cabinet Secretary in Parliament indicate that the plan in terms of what they will publish is still the same. But it’s, their intention to provide that kind of indication of multi-year is dependent on what information they get from the UK Government.
But as far as what is going to be published, there's a number of different documents

they intend to publish, including a spending review and all of that is still planned to happen. It's just it's just when that's going to happen and then the Budget Bill formal process through environment is a lot more contracted than normal.
Derek Yule
OK. Thanks for getting the additional information about Falkirk Council. I'm still not sure I've got my head round what they're saying compared to how the service concession would play in that, but happy to .take that outwith the…
Mike Neilson 1:03:03
Thanks from me for the information in relation to the UK government funding. I was very struck by the, the fact that 75 towns including 10 in Scotland, the neighbourhood boards in those areas are due to submit locally produced regeneration plans to the UK Government, which prompts the obvious question of how does that fit in with, as it were, local authority, Scottish Government, etcetera, regeneration plans?
Are you, are you aware of whether that, that issue is being addressed as it were, explicitly, or whether there is, it's going to be an issue just for local determination.

Joe Chapman 1:04:01
I know there's a number of different funding programmes including Scottish Government make their own kind of grants to specific areas in similar schemes as well. In terms of the UK Government funding through the plan for neighbourhoods etcetera. I know actually my home town is one of those that has was part of the first tranche. So I've seen how that process has played out and it doesn't really involve local authority or the Scottish Government as far as I can tell.
It is that the funding is provided from the UK Government, the community forms a board, which does have local authority representation as well as various other local stakeholders.
And through community consultation, they've come, they've come up with a list a wish list if you like, of ways to spend 20 million and they're looking now at how that can fit together in terms of the different pieces that might make up a total of that sum. And that plan is now being presented to the UK Government in order for the government, the UK Government to then make that judgement as to whether that's a robust enough plan. So it’s in a way is kind of bypassing the local authority and SN… and Scottish Government.
But as I say, there are kind of equivalent measures that Scottish Government has to fund similar types of projects in similar types of ways.

Jo Armstrong 1:05:27
I suppose it's picking up that, Mike, maybe I'm misunderstanding the question, but it's suggesting there's potentially two views of a region and two different geographical kind of structures around that region, which…

Or possibly three. So it might be something we want to ponder about. How do we get a better understanding of how those are or are not joined up, and the extent to which it then means not best value for the resource being utilised in all of them.
Any other questions for Joe? Again triggers lots of thoughts, Joe. Thank you.
Takes us to chair’s report.
I just wanted to pick up a couple of things. One is clearly going through the six-monthly check in which I think is mostly finished, which has been good just to give me a chance to understand where any issues or concerns might arise. All good so far. We had, Sarah and I had a very good session with the Permanent Secretary in October, principally to give him a heads up about our desire to make sure that public service reform is not impeded in any way by our formal duties in oversight of the local government part in public service reform, but I think he took that well, and as a consequence there’s a follow up meeting with some of his officials. So that was a good session.
And I'm also I've reached out to and have had managed to get agreement with the Convener of the Local Government Committee, Ariane Burgess, for a meeting on the 4th of December. I'm really keen that we get a chance, the Accounts Commission gets a chance to have a different relationship with that committee as a way of giving us a chance to have more of our thinking used in their, their scrutiny.
So the start of that is going to be, as I say, on the 4th of December.
And just to confirm that we've also got a desire to make sure that the North Ayrshire example is used as a good example of transformation, so I'll use that on the 4th of December and I know there's the follow up meeting coming up. I don’t know what the date is, next week, yeah.
So that will be… That's really all I wanted to flag up, but good material and good reception from those that we're meeting and getting out there a bit more.
Any questions anybody’s got on…?
That takes us then to any other public business anybody wants to raise?
That takes us to the end of the session. If I can ask Lee to switch off the recording.