Treasury Committee

Oral evidence: Government Internal Audit Agency, HC 786
Tuesday 9 February 2016

Ordered by the House of Commons to be published on 9 February 2016

Watch the meeting

Members present: Andrew Tyrie (Chair); Mr Steve Baker, Mark Garnier, Stephen Hammond, Mr Jacob Rees-Mogg, Rachel Reeves

Questions 1 - 76

Examination of Witness

Witness: Jon Whitfield, Chief Executive, Government Internal Audit Agency, gave evidence.

Q1   Chair: Thank you very much for coming to see us this morning.  This is your first visit before the Treasury Committee and it is the first time this body has had an opportunity to appear anyway, since you have only been in formal existence a few months and you have been operating as a shadow body, I gather, for just under 18 months, since October 2014, so I have just learned.  The first thing we need to establish is what you are responsible for and what you are not responsible for.  I have had a look at your website and cannot work it out.  There is at least a vacancy notice that was published last month, which supplies a bit of information about which Departments you are looking at and which Departments you are not, so far, or are responsible for and are providing services for.  As I understand it—correct me if I am wrong—you are doing the Cabinet Office, BIS, DCLG, DCMS, DfE, DECC, DfT and the Treasury.

Jon Whitfield: That is correct.

Chair: There is work in progress for the transfer of Defra, DWP, the Home Office and the MOJ. 

Jon Whitfield: That is correct.

Q2   Chair: You are not looking at DFID, which has this huge increase in the aid budget; the Department of Health, which many might say is due an audit or two; the Foreign Office, which many people might feel is due an audit or eight; HMRC, which is very well worn territory for Parliament to cross‑examine over their internal functions; and the MoD, which some MPs feel is past remission.  You are not looking at any of the hard cases, are you?

Jon Whitfield: The origin of the agency is that smaller Departments such as those that you have mentioned gathered together, before the policy to create the agency, in a shared service function, which I could characterise as a coalition of the willing.  Partly by accident and partly by design, those with an interest in the service we are providing came to talk to us about the merits of joining.  That brought together the eight Departments that you have listed and then, in December of 2013, it was announced that, partly as a result of the success of that service, the concept would be extended to the whole of Government.

Q3   Chair: This is a voluntary thing.  Departments can volunteer to join you.

Jon Whitfield: It is now Government policy that they should join, and the conversations that we are having with the Departments that you have listed have been about the appropriate timing of their joining.

Q4   Chair: Why are there no conversations taking place with the hard cases?

Jon Whitfield: We have had some conversations with the hard cases. 

Chair: I have exaggerated the scale of the hard case problem. 

Jon Whitfield: The policy has been to extend the agency concept to those organisations that are within the shared service, so the eight Departments that you have named.  We have then had conversations with DWP, the MOJ, the Home Office and Defra, as you say.

Q5   Chair: What I really want to know is when you are going to get responsibility for those five that I just listed at the finish there, the hard cases that are listed in this vacancy notice as being retained by the Department at present. 

Jon Whitfield: The timetable for those has not yet been determined.  We have a timetable for the four Departments that you have named and also an agreement in principle for HMRC to join in April.

Q6   Chair: I would be grateful if you could send us a note setting out a timetable for those, as soon as you can.  That should be a matter of weeks or months.  We certainly do not want that to become years.  If they are going to be excluded, we need to know.  Secondly, it might be helpful if you put in the public domain all this information in a formal way, rather than Parliament and the public having to rely on a vacancy notice, since there is no formal notification even of what you are responsible for.  The next point has to be: what about agencies?  Which agencies are you responsible for?  Again, there is no information that I can find, or only scant and scattered about, about those.

Jon Whitfield: I have a list of all the bodies that we currently provide the service to in front of me.  It is arranged in order of size, but I can run my eye down and pick out some of the larger ones.

Q7   Chair: It might be helpful if you publish it and put it in the public domain immediately. 

Jon Whitfield: Yes, certainly.

Chair: It might be helpful to have a list of those that are under consideration and those that are not under consideration at present, and whether you are intending to bring them under your purview.  We have discovered today that you are intending to bring these other Government Departments under your purview, the ones that are excluded at present under this vacancy.  That is a helpful first step. 

Now, when you go in and do these audits, what are you going to achieve that the departmental audit process did not?  Before, each Department ran its own show.  Now you are taking this over centrally.  What is the value‑added of this new outfit that you are heading up?

Jon Whitfield: It falls into a number of different categories.  The first is, by virtue of size, we can provide a more responsive and resilient service.  The core of the intention is to build on that and create a more capable internal audit service for Government that is able to make a greater contribution to the achievement of good public service outcomes.  Part of that is to construct a career proposition for professional auditors within Government, which has clearer career paths for advancement.  We attract better talent through a career proposition that allows auditors to work in different parts of Government, providing an interest, which hopefully will help us compete better with the private sector for the top talent. 

Q8   Chair: You can recruit better staff to do the internal audit work, because you are providing a better offering for employees.

Jon Whitfield: That is part of it, both from within the Civil Service ranks and from outside.  There is also an ambition to more than the sum of our parts inasmuch as, in the past, when internal audit services have effectively been operating in silos, they may well have served their organisations well but, increasingly with the delivery of Government policy dependent upon different bodies within Government working together, by having a single service we can, where appropriate, work and provide assurance across those organisational boundaries.

Q9   Chair: We already have a case study to hand, which is the work that you have done on Kids Company.  It might just be worth having a look at this.  You looked at this; you reviewed oversight of payments and delivery, and looked at a sample of the charity’s performance reports.  You concluded, in November 2014, that the “Cabinet Office had satisfactory reporting and assurance arrangements in place for administering the Kids Company grant”.  That presumably was a mistaken conclusion, was it not?

Jon Whitfield: I do not believe it was.  Our report highlighted four key issues.  The first related to cash flow, which was a point raised in the NAO’s report of last year when, with the benefit of hindsight, they looked at the facts of the matter pertaining to the operation of Kids Company.  One of the other four key findings of the report was in connection with the monitoring of grant.  It picked up on the need to look more closely at outcomes, rather than simply the number of interventions, which again the NAO report had picked up.  Prior to that, our report had highlighted for the Cabinet Office to continue to take action on that.

Q10   Chair: We know now that the reporting and assurance arrangements were not satisfactory.  We know that the Cabinet Office should already have been taking rigorous action to curtail grants to Kids Company, do we not?  The evidence for that is overwhelming.

Jon Whitfield: Our report, at the time it was done, looked quite narrowly at what the Cabinet Office was doing.  It picked up on the report that the Cabinet Office had commissioned from an independent source, only a few months earlier, to look at those monitoring arrangements.  As I say, I did identify one of the key facts of that report, which was that the monitoring needed to not just look at the number of interventions, which was quite high and significantly above what Government had expected, but rather look at what outcomes the charity was actually bringing about with the investments made.

Q11   Chair: That is the point you have just made about outcomes, but the bottom line on this, and it is quite a big bottom line, is that the Public Accounts Committee concluded less than a year later that “The metrics Government used to assess Kids Company’s performance were severely ill‑judged”, and “there was clearly something wrong with the reporting and measurement framework” for the grant.  That is exactly what you are describing here: outcomes.  That is what that is a reference to, although it does not use the word.  You came to the opposite conclusion.

Jon Whitfield: From the time that the Cabinet Office took over responsibility, in July 2013, a series of actions were initiated, which played a significant part in precipitating what followed, including the eventual folding of the charity.  The timing of our work was quite close to the Cabinet Office having taken over that responsibility.  Two key issues highlighted in that report emphasised the importance of follow‑up on the actions that the Cabinet Office had already taken in relation to the charity.

Q12   Chair: It does not look very good really, does it?  Do you accept now, with the benefit of hindsight, the Public Accounts Committee’s conclusion that the metrics used to determine how the money was spent were fundamentally inadequate?

Jon Whitfield: My reflection on the Kids Company case, dating back more than 15 years as it does, and involving a number of Government bodies, Government Departments and others that were responsible for funding, is that it does raise some fundamental questions about how it was that this situation was perpetuated for as long as we now know that it was.

Q13   Chair: What I am trying to get it is what we are really going to have as value‑added from the internal audit body that has now just been created.  It sounds good; everybody would say that internal audit is a good thing, but it can quickly degenerate into motherhood and apple pie territory.  We have a case study, which is really the first good one, up in front of us almost immediately, and it is not auguring well for the way that this work is being conducted.  Again in April 2015, the Cabinet Office paid the annual grant of £4.3 million to Kids Company in one go, rather than in quarterly instalments as it had previously done.  The PAC called that move “ill‑judged and gullible”.  Did the Cabinet Office consult you about that?  That is what internal auditors are there for: they can be consulted internally when such decisions are taken, exactly decisions such as that to pay money out in one go, rather than quarterly.  Was there any consultation?

Jon Whitfield: I do not believe there was.

Q14   Chair: Have you investigated why you were not brought in and consulted?  You were already up and running as a shadow body.

Jon Whitfield: I have not investigated that.

Q15   Chair: Do you think it might be worth a look?

Jon Whitfield: It is certainly worth looking at the whole question of the issues drawn out by the NAO report, which highlight the fact that, since 2002, there have been a number of issues arising in relation to the charity, involving a number of Government bodies.  My reflection when I read that report was that this is exactly the kind of territory that the Government Internal Audit Agency was created to seek to address.

Q16   Chair: You were already up and running.  This is the point that I am getting at.  If this had all happened five years ago, the point you have made, it seems to me, would be very well taken, but you were up and running.  You had produced a report on it only a few months earlier, five months earlier, saying that there were satisfactory reporting and assurance arrangements in place.

Jon Whitfield: The report that was done for the Cabinet Office was based on a Cabinet Office assessment of the risks that the funding of the agency posed to that organisation.  Having read the NAO report, I am reflecting that, consistent with our ambition to be more than the sum of our parts, there is a responsibility on ourselves, the Government Internal Audit Agency, to stand back from such issues and see if there is not learning from elsewhere in Government.  In this instance, there was learning from the experience of other Departments that are still not yet within the agency and, as the NAO report says, in respect of experiences of funding the agency, which go back over 15 years.

Q17   Chair: You did not pick those up in that review in November 2014.

Jon Whitfield: We did not pick them up.  The scope of the review was set to answer a number of questions relating specifically to the risk to the Cabinet Office. 

Q18   Chair: This is a Cabinet Office risk.  It is full square on their territory.  Therefore it is full square within the remit that you were given.

Jon Whitfield: The remit of the Cabinet Office was clear.  The actions taken by the Cabinet Office since it took over responsibility in July 2013 were significant.  The work that we did, as part of the audit programme agreed with the Cabinet Office audit committee, was to look at one relatively narrow aspect of the arrangements for the monitoring of grant.  With hindsight, clearly more has come out, going back over a number of years and involving a number of different Government organisations.  Had there been some indication of that at the time, it might have caused us to reflect on scope, but the report that the NAO did, which had the benefit of hindsight and going back over that period of time, is an illustration of where a Government Internal Audit Agency that has the ability to look across all Departments of Government has the potential to make more significant interventions.  As I say, the scoping of the work for the Cabinet Office was done on the basis of the Cabinet Office’s assessment of risk.

Q19   Chair: I do not know why you keep coming back to scope, as if this somehow was excluded from your work, when it so clearly is included within the spirit, if not the letter, of what you were being given the task of achieving.  Maybe we are like ships passing in the night on that exchange and should move on.  I realise that this is a very bumpy first session, but it is the job of this Committee to make these points.  I made sure that you had advance notice that you were going to be asked about Kids Company, and we are very dependent on you doing a good job, in the best interests of value for money for the taxpayer. 

You raised one point about lessons learned with the advantage of hindsight.  There does seem to be one aspect of this that an internal auditor is in a uniquely strong position within Government to handle.  That is with respect to lines of accountability to advisers and Ministers.  One question that still seems to be hanging somewhat unclearly, from all the work that has been done, despite the best efforts of the Public Administration and Constitutional Affairs Committee, is how it came about that this instruction or direction was made by Ministers to overrule the concerns of the accounting officers, what role internal audit played in that process and what this tells us about the relationship between No. 10 and other Government Departments.  That is a long question or a long statement.  Have you any comment to make on any of those points?

Jon Whitfield: I do not think I can add much.  Certainly, internal audit was asked to do no work around the fact of the direction.  That was a conclusion that the accounting officer reached, on the basis of the knowledge that he had.

Q20   Chair: I am sorry to interrupt all the time but, when an accounting officer seeks a direction, this is a pretty serious event in Whitehall.

Jon Whitfield: It is.

Chair: It normally triggers alarm bells of fire alarm proportions.  Is the internal auditor not immediately consulted about this, as a matter of routine, and if not why not?

Jon Whitfield: As you say, it is not a frequent occurrence.  It has not been my experience that internal audit is consulted as a matter of routine. 

Q21   Chair: Why not?  Prior to the event, why does the accounting officer not come to you and say, “This is extremely tricky.  What do you think about it, internal auditor?”  Is that not what you are there for?

Jon Whitfield: It is an option for accounting officers to so consult.  If an accounting officer is going to act in such a manner as to request a direction, then I would assume that that accounting officer is in possession of all the facts that they believe they need in reaching that conclusion.

Q22   Chair: They may get it wrong.  That is why internal audit is there.  If the executives always take the right decisions, we can abolish the internal audit process in all organisations, public and private.  They are there specifically for this purpose.  Having served on boards in private companies, when there is an awkward question that one or the other of the finance director or the chief executive gets nervous about, they trot along to internal audit and have a chat before taking it to the board.  It seems to me that none of that has taken place here.  It is absolutely astonishing.  If may say so, your reaction to my question is also concerning because, even with the advantage of hindsight, the big lessons that need to be drawn from what has gone wrong with Kids Company do not seem to be being drawn yet.  Have you any thoughts to add on that?  To put it as a question, is it not of concern to you that we do not have standard procedures for involving internal audit where direction is sought?

Jon Whitfield: The issues that internal audit are involved in may or may not result in a direction.  As you have already observed, instances of direction are very rare, so internal audit’s involvement in those issues that come close to, but fail to result in, the request for a direction may well be numerous.  Once a direction has been sought, there is a legitimate question as to whether or not internal audit should be used to give an independent view as to the circumstance that resulted in that direction being requested. 

Q23   Chair: It is easier to think of the circumstances in which that should take place rather than should not, do you not think, Mr Whitfield? 

Jon Whitfield: The circumstances around the direction being sought in the Kids Company case built over a considerable amount of time, as the Cabinet Office’s knowledge of the funding of the charity grew.  Our involvement was limited to the review that you have referenced.  We have talked about the conclusions of that. 

Q24   Chair: Have you sought to trace where the origin of the decision lay?  A decision was taken to give grants in the face of considerable concern.  This led to directions being sought and obtained.  Have you got to the bottom of the source of the pressure for the decision being taken in the face of that direction?

Jon Whitfield: No, we have not investigated that.

Q25   Chair: Why not?

Jon Whitfield: The programme of work that we have for this year has not included it. 

Q26   Chair: That is just saying, “We haven’t”.  While it seems to me pretty basic, something has gone really seriously wrong.  Many are saying that the Prime Minister created conditions in No. 10, or whatever it may be, that led Ministers or advisers acting on his behalf to bring pressure to bear to authorise the release of this money, and we need to know where the decision was taken, do we not, Mr Whitfield? 

Jon Whitfield: With the parliamentary committee that you have referred to conducting an investigation, it was clearly not felt within the Cabinet Office that an internal review was necessary or would have been commissioned to do it.

Q27   Chair: It was not felt by whom?

Jon Whitfield: We were not commissioned to do it, so I assume those who have the power to commission us, which is the accounting officer.

Q28   Chair: Have you discussed this with the Cabinet Secretary?

Jon Whitfield: No, I have not.

Q29   Chair: Do you not think this is something that should be discussed with the Cabinet Secretary: powers of direction being sought and obtained, clear misallocation of funds, allegations of normal processes of decision‑making and scrutiny in Departments being overridden by the Cabinet Office?  Is this not absolutely the bread and butter of your job?

Jon Whitfield: I will reflect on all the information that is now in the public domain, as a result of the various inquiries that have taken place.  If it is my judgment that we can add to what is already there, in terms of the knowledge of this case, then it would be my intention to intervene.  I am not yet in a position to judge whether or not that is the case.

Q30   Chair: It may or may not have been a good idea to have created your body but, I hope you do not mind my saying so, listening to the replies I have just heard gives me no confidence that the fact of you now existing would give us better protection from what appears to have been quite a serious mistake in misallocation of public funds to a charity.  I have no confidence that that will not happen again and that we have better protection.  I find it particularly concerning that, even after the event, you have not actively sought to find out in great detail how that decision came to be taken and to be able to tell us.

Jon Whitfield: As I say, the investigations as to what led to the demise of Kids Company and the related actions have only just concluded.  I have not had the opportunity of reading all the things that are now in the public domain.  If there is a gap in our knowledge, which will be served by filling in order to prevent such instances happening again, it would be appropriate for us to intervene.  Until I am in a position to exercise that judgment, I cannot say whether or not that would be appropriate.

Q31   Chair: It might be helpful if the Committee could have a look at the November 2014 review.  Could we see that, please?

Jon Whitfield: Yes, I can arrange that.

Q32   Stephen Hammond: Good morning.  Could I take you back to why you were set up?  Perhaps we could run through some of the changes.  The National Audit Office report of 2012 explicitly said that Government do not gain the most out of the money they spend on internal audit.  They are not functioning and focusing on the right issues and there is not sufficient quality inside the body to be useful in terms of decision‑making.  Could you lead us through what has happened since then in the setting up of your body, so that we can understand how those concerns have been addressed and what you have put in place?

Jon Whitfield: Yes, certainly.  First of all, it is important to recognise that, when internal audit was, as it still is in large parts of Government, conducted by largely autonomous units, there was a great deal of difference in the way that the public sector internal audit standards were interpreted.  The construct of the agency was there, in part, to provide a greater standardisation of approach, so that some of the criticisms in the 2012 report from the National Audit Office about the variation in quality and approach of internal audit could be directly addressed. 

Q33   Stephen Hammond: In terms of that variation of approach, does that mean that you have a whole new cadre of people inside or have you taken the departmental people and tried to change their view?

Jon Whitfield: We have taken the departmental people who worked in those separate units.  We have brought them together and adopted a common way of conducting internal audit within the agency, which will be progressively adopted across Government, as others join.  That has been accompanied by a new regime to quality assure what we do, including an agreement in principle that I have reached with Sir Amyas Morse, the Comptroller and Auditor General of the National Audit Office, that the NAO will, according to arrangements yet to be agreed, provide an annual quality assessment of the work of internal audit.  As I say, details of that are still to be worked through.

Q34   Stephen Hammond: Again referring back to that June 2012 report, the NAO said there were some real issues about internal audit identifying some of the issues and problems with that, at that stage.  One was the expertise on IT‑based information systems, identification of efficiency problems in organisations and ability to offer advice to senior management.  Can you explain what is in place now, so that those sorts of issues have been overcome?

Jon Whitfield: It would be premature to say that they have been overcome.  We have begun the journey of addressing those issues.  This comes down, in large part, to a point of capability, as well as to the way in which our work is conducted.  The internal audit service in central Government is provided fundamentally as a mix of the in‑house internal audit staff that individual Departments, organisations and now the Government Internal Audit Agency employ and expertise that we call on from the private sector. 

We have an ambition within the agency not just to attract the top talent from within Government and appeal more from a career perspective to those who might want to join us from outside, but also to strike a better deal with the private sector, such that we get better value for money from the contractors that we use to support us.  In the summer of the last calendar year, we were successful in letting a new framework contract from within the Government Internal Audit Agency, which can be drawn upon by all internal audit units within Government, whether they are in the agency or not.  That, for the first time, has broken what was previously a monopolistic arrangement between individual Departments and a single external supplier. 

No Department was big enough to support a framework for multiple suppliers.  The agency is just about big enough to do so now, and we have gone to the market and secured a range of suppliers from the private sector, which gives us access to the skills and expertise that we cannot retain within our Civil Service ranks, at more competitive rates.  It is also crucial that, by virtue of breaking the monopolistic arrangement between individual organisations and a single supplier, we have introduced a commercial tension into those arrangements, such that we can, by trial and error using different contractors on different types of work, identify which provide better value for money for the various aspects of specialist assurance work that we need to call on.

Q35   Stephen Hammond: You think that that framework is a good indication of value for money now coming out of the service.

Jon Whitfield: It would be premature to say that it is a good indication.  I think it gives us a good opportunity.  What I can say is that, on the main lot, which is the bulk of internal audit work, the cheapest suppliers, which are a range of suppliers from different‑sized firms, are something like 40% cheaper than what we had been paying in the past.  How much of a saving that actually gives the taxpayer will be entirely dependent on the mix.  We will not always draw upon the cheapest supplier; that would be inappropriate.  Different expertise is required.

We have an opportunity to use the private sector more flexibly to access a range of suppliers, including the Big Four[1] as well as firms from the next tier down, which give more competitive rates, such that we can have a blend that represents better value for money over time.  The reason that I cannot quantify those savings currently is that the framework has been operating for only a few months and, in fact, the amount of work that has been called on from that framework from the time the contract was let in the summer to the end of the third quarter of the current financial year was really quite small.  Significantly more is being drawn down in the fourth quarter, the final quarter of this year.  Once that delivery period is complete, we will be able to analyse exactly what we paid for and what we got, and quantify that saving.  What is crucial is the opportunity that this gives us to use the private sector more flexibly.

Q36   Stephen Hammond: Following on from that, will the NAO review your performance five years post the 2012 report?  Although you are a relatively new body, it would be sensible to review five years after their previous report.  Do you expect one of the benchmarking factors to be the success of the frameworking arrangement?

Jon Whitfield: Last time I spoke to Amyas about the likely timing of the review, he had not concluded.  It would be very surprising if there was no review around about the five‑year timeframe that you cite and, yes, I would expect that framework to be part of our success story, in terms of getting better value for money and access to the right expertise at more competitive rates.

Q37   Stephen Hammond: If that is one way of assessing value for money of your organisation, how else should we look to assess whether you are delivering value for money?

Jon Whitfield: It is really quite difficult to assess the value for money of an internal audit service.  One has to look at a range of indicators, rather than just one or two killer metrics.  Partly that is the nature of what we do: it is very difficult to prove a negative.  If interventions from internal audit have been instrumental in bringing about better outcomes, it is very difficult to prove.  It is far easier to look at failures and ask the question, “Where were the auditors?”  While we will put in place and have in place metrics that can point to the efficiency of what we do, ultimately proving the success of what we do is more difficult and, to some degree, has to incorporate a form of subjective judgment on the part of the recipients of our service.  It is a suite of measures.  We will make as many as we can objective, but with some subjectivity as well.

Q38   Mr Baker: When will you publish your annual business plan and report?

Jon Whitfield: We have a business plan that is available now, pertaining to our first year of operation, and we will produce an annual report and accounts in line with the normal parliamentary timetable, around June of this year.

Q39   Mr Baker: To whom is that plan available?

Jon Whitfield: I believe the plan is available on our website. 

Q40   Mr Baker: Is that the case?  Can I ask the Committee staff if they have had the plan?  The clerk is not listening.  I understood that your business plan was not in fact available on your website and available to the Committee.

Jon Whitfield: If it is not, I apologise.  I thought it was.

Q41   Mr Baker: For this Committee, it is absolutely crucial that there is a clear plan published and then a report against that plan, so that we can scrutinise what you are doing and how you are making progress against it.  Do you not think that, for us, it is a matter of astonishment that you are standing by your judgment on Kids Company, given all that has been said about the failure there?

Jon Whitfield: The conclusion on Kids Company can be seen only in the context of the report.  The Committee has asked for the report; we will make that available to you.  The NAO report that I have since read points to a very large number of issues affecting a large number of Government organisations and going back over a large period of time. It is understandable and right that we should draw conclusions on the basis of all of that information. 

The reason I referred in my previous answers to the scope of work that we were asked to do for the Cabinet Office was that, of course, there are an awful lot of Government activities of which the work of internal audit can only look at certain aspects.  It would be possible to go back in time for as far as one wanted, or expand the scope as far as one wished.  Without any indication of the need to do so, which has to be informed by a risk analysis of the particular issue at hand, one has to do whatever is appropriate at the time in one’s judgment.  That is a dialogue between internal audit as a professional service and the customers of that service, which include the executive and the audit committees of the organisations to which we report.

Q42   Mr Baker: When we are looking at a shiny, exciting, new 2016 plan, what is the top line of your purpose, in a couple of sentences? 

Jon Whitfield: I would answer that by saying it is about making a greater contribution to bringing about successful public service outcomes.

Q43   Mr Baker: I hope you will forgive me.  I do not wish to say that sounds like “waffle”, but it does not sound very distinct from what anyone else might say about their purpose in public service.  What is the purpose of your agency in carrying out audit?  What is distinct and unique about what you bring to that purpose?

Jon Whitfield: We bring an independent view, in terms of the systems in place for governance, risk management and control, designed to reduce risk and bring about better outcomes.  The fact that we operate as an independent body within Government is crucial to being effective in that space.  The three lines of defence model is typically used to describe where we sit.  We are in the third line as an independent function.  We report to the accounting officers of the Government bodies that we serve and we are there to provide independent advice and challenge to what the executive is doing on behalf of the accounting officer.

Q44   Mr Baker: There we are: it sounds like we have written the foreword to the new plan together this morning.  The Civil Service Progress Report from December notes that one of your aims is to “increase the likelihood of successful and cost‑effective delivery of Government services”.  How are you going to know if you have achieved this, and how will we know whether you have achieved it, without a publicly accessible annual report with measureable outcomes?

Jon Whitfield: It is certainly the ambition to provide a report that covers our activities in Government and seeks to draw that out.  It is my intention in the summer, alongside our annual report and accounts, to produce a report that looks at the audit activities we have undertaken in the proportion of Government that we currently provide a service to, and draws out themes that we believe can be learning for other parts of Government. 

As I have already said, it is difficult to point to successes in terms of public service delivery and, hand on heart, to say that internal audit has made the difference between success and failure.  There are a large number of internal audit reports delivered across Government.  One could look at any of the successes that Government have and, if an internal audit report has contributed in that area, take some credit for the success.  I am uncomfortable in doing that.  I think that internal audit plays a small but significant part.

Q45   Mr Baker: On that point then, in terms of producing success, what powers do you have to require change?

Jon Whitfield: Our powers are exercised through our direct reporting to the accounting officer and to the audit committee.  The effectiveness of audit committees varies in organisations, for a variety of reasons, but relatively recent changes to the constitution of audit committees—where we have wholly non‑executive membership; the chair at least, and often other members of the audit committee, being on the board of organisations; and significantly, that direct reporting to the accounting officers—give us the direct access we need and the opportunity to have the dialogue with accounting officers, who can then exercise their authority over their organisations to bring about the change that internal audit will indicate is necessary.

Q46   Mr Baker: Could an annual report from your agency set out specific instances of where you had made concrete recommendations to an accounting officer and how those recommendations would subsequently be implemented, in order that we could see the direct and unique value that your agency brings to Government?

Jon Whitfield: Certainly, that information is available to all audit committees, which typically track the implementation of internal audit recommendations within the organisations that they serve.  In fact, internal audit works very closely with audit committees to ensure that the executive is indeed following up appropriately on internal audit recommendations.  It is typical that audit committees will take, at each meeting, a report from internal audit on progress with those implementations.

Mr Baker: The point I am making is that it would be wonderful to sit here with a report in front of us that makes absolutely plain, for anyone to see, the concrete successes of your agency in Government.  Instead, what we have had is a rather diffuse conversation about the extent to which your agency did not prevent the Kids Company fiasco.  If I may offer advice, it would be far, far better if we were sitting here with a document that made absolutely explicit what you had hoped to achieve and what had been achieved in the year, and demonstrated, through your recommendations to accounting officers and how they had been implemented, in concrete terms, the improvements in public services that you had brought about.  I will leave it there, Mr Chairman.

Q47   Chair: I understand that your annual business plan is not available on your website.  Why not?

Jon Whitfield: It should be.  We will make it available.  I thought it was, as I already stated.  My apologies.

Q48   Mr Rees-Mogg: Mr Whitfield, to whom do you report within the Whitehall hierarchy?

Jon Whitfield: I report to Julian Kelly within the Treasury, who is the Director General of Public Spending, and to the accounting officers that the agency serves, in terms of my responsibility for the service to them as accounting officers.

Q49   Mr Rees-Mogg: Is that senior enough for you, because of the considerable responsibilities that you have?  Ought you to be reporting directly to the Cabinet Secretary?

Jon Whitfield: There is an argument, in terms of the profile of internal audit within Whitehall, for a different reporting line.  The effectiveness of the function, though, is derived from the direct reporting to accounting officers in relation to the service we provide, and that reporting line is in place and is exercised when I believe it necessary.  I act as the head of internal audit myself in Cabinet Office, so have regular meetings with the Cabinet Office accounting officer.  Others who act on my behalf, in relation to the other bodies that we serve, will have similar meetings with their accounting officers.  That access is the most pertinent to the effectiveness of the service.

Q50   Mr Rees-Mogg: Accounting officers have a degree of personal responsibility for any misspending, which is when it comes into the instance of Ministerial direction if that is to be overruled.  That is correct.

Jon Whitfield: Yes.

Q51   Mr Rees-Mogg: What I am trying to get at is whether you have the political backing to do your extremely difficult job.  You are overseeing some Departments that are very powerful, including the Cabinet Office, which is very close to the Prime Minister.  They probably do not like being told that they are spending money badly or discouraged from spending money in a way that they want.  I just wonder whether you feel that you have sufficient political clout in the Whitehall set‑up to do your job as effectively as possible.

Jon Whitfield: There is no question that the construct in the past has been somewhat different, in terms of internal audit reporting to individual accounting officers.  It has been within the gift of individual accounting officers to effectively determine the status of the internal audit function within their organisations, and that status has varied, although there is guidance in the public sector internal auditing standards and elsewhere as to how that status can be assured.  

The Government Internal Audit Agency at the moment covers only eight of the 17 Departments, and our number of auditors is still under 200, with over 700 individuals practising internal audit across central Government.  We are a young body yet to cover the majority of Government.  In terms of the ambition to provide a service that is more than the sum of its parts, in particular a service to the whole of Government, as opposed to just individual accounting officers, we have some way to go not only to establish that service, but also to understand what would make it more effective, more quickly.

Q52   Mr Rees-Mogg: I notice, in terms of the Departments that you have and the Departments that you do not have, that the most powerful Departments have not yet come to you, so the Home Office, the Foreign Office and the Ministry of Defence.  Does that tell us something about a power struggle in Whitehall and about how these Departments protect their fiefdoms?  Is that more of an underlying problem for you in that, actually, powerful Departments resent more centralised interference and always have done?  They do not want to be controlled by the Cabinet Office; they want to maintain their individual status and power.  You have the Treasury, because the Treasury is supporting this effort—it is a driver for it—but that is the only one of the really powerful ministries that you have.

Jon Whitfield: I sense that there is an ambition on the part of Departments to acquire a stronger and more effective service.  The Home Office and DWP will transfer into the agency and take their service from us from 1 April this year.  That is the planning assumption, so I expect those Departments to join on 1 April. 

When it was announced that the agency was to be created in December 2013, as I described in answer to a previous question from the Chair, the Departments that we were covering as a shared service had effectively been acquired as a coalition of the willing.  Those that had not come and talked to us and sought to take service from that shared service had done so primarily because they were satisfied with the service they were getting.  Therefore, the conversations that I have had with the Home Office, DWP, the MOJ and Defra, which are all Departments that have signed up, in principle, to joining over the next 12 to 15 months, have been around first of all ensuring that the transition into the agency does not result in any detriment to service. 

They recognise that there is the potential for the agency to provide a change in service such that it gets better, not just for the reasons that I have stated—that we should be able to attract better people and put different constructs for delivery in place—but also recognising the opportunity to provide assurance across organisational boundaries, to learn lessons from one part of Government and spread them to others, and also to raise flags of issues and risks that are identified in one part of Government before perhaps they manifest themselves in another.  This is all part of the ambition, so the conversations that I have had with Departments have been in recognition of that. 

While I recognise what you say about the attitude of Departments in some respects, in the assurance space, they are susceptible to the argument that the agency can provide a better service in the longer term.

Q53   Mr Rees-Mogg: Do you have a sufficiently powerful political sponsor to help push that through?  You told me to whom you reported in the official line, but to whom do you report in the political line?  Who is your sponsoring Minister?

Jon Whitfield: The sponsoring Minister is the Economic Secretary to the Treasury. 

Q54   Mr Rees-Mogg: He does not necessarily seem to be giving you a lot of political cover, when it took you a moment to remember who it was.  You have such an important job to do.  You were investigating, with the Kids Company, a pet scheme of both this Government and its predecessor Government.  For you to have come out with a report that said, “This money has been badly spent for the last 10 years and there is something fundamentally wrong” would have been, to use Sir Humphrey’s speak, “courageous”, and yet you have quite junior political sponsorship.  To be able to be as forthright as you would like to be, do you think you would need to have the Prime Minister, the Chancellor or the Home Secretary, one of the really powerful political figures, to back you?

Jon Whitfield: It would be an odd answer to suggest that, with such backing, the job might not be easier.

Q55   Mr Rees-Mogg: Have you ever come under political pressure, in any of your reports, to just be slightly gentler?

Jon Whitfield: Not to be gentler.  There have been occasions when there have been political interventions seeking to alter scope of work, but not actually, in my experience, to influence how the findings of work are presented.

Q56   Chair: It seems to me that you need a line of accountability directly to the Permanent Secretary to the Treasury, in the first instance, with a line of appeal to the Cabinet Secretary.  Without that at staff level, you are not going to get anywhere.

Jon Whitfield: That line of accountability exists by virtue of the fact that—

Q57   Chair: It does not.  You have just told us that your direct line of accountability is to the head of public spending.

Jon Whitfield: I also regard myself as reporting, as an accounting officer for the agency, to Sir Nick Macpherson, as the Permanent Secretary to the Treasury.  Also, in relation to my role as the head of internal audit for the Cabinet Office, I have a line of reporting to the Cabinet Secretary, by virtue of the responsibilities of that Department.

Q58   Chair: If I may say so, and challenge me if you think I am wrong, from the exchange you have just had it sounds to me like you are billed as having independence, but in practice your agenda is being set by others.

Jon Whitfield: I do not believe that is the case.  I believe we are independent.  The independence of our work is assured by a number of mechanisms: the direct access to the accounting officers, which I have referred to; and the relationship that we have with audit committees, which are there to support the accounting officer in ensuring that independence.  It has not been my experience that that independence has been compromised or regularly threatened.

Q59   Mark Garnier: Good morning.  Could I ask you what your budget is for the current financial year?

Jon Whitfield: It is £30 million[2].

Q60   Mark Garnier: How does that compare with the budget as it was when it was distributed among other organisations?  Is it an amalgamation of that?

Jon Whitfield: It is pretty much comparable.  There have been no significant changes in the amount of audit activity since we were created, so it is broadly comparable.  A relatively small element of that budget is the cost of establishing the agency, but that is less than 10% of that.

Q61   Mark Garnier: That is fair enough.  Is it all funded entirely from HM Treasury?

Jon Whitfield: It is funded through fees, effectively, so all of our customers are charged for the audit work that we undertake.  The Treasury funds a small amount of policy activity, which is within their gift, and also the cost of actually transitioning organisations into the agency, so that those costs are not borne by the organisations coming in.

Q62   Mark Garnier: Hypothetically, if you did not have any work in one year—I know it is a completely hypothetical situation—presumably the Treasury would fund you and then charge it back from your customers.

Jon Whitfield: Our framework document provides for the Treasury providing funding if there was a dramatic reduction in demand for our services.  By virtue of our size, we are more proof against such changes in demand in one area of Government than we would be if we were separate organisations.  Also in terms of proof against that fluctuation in demand, by virtue of the fact that a lot of the service we provide is bought in from the private sector, again we can turn that tap on or off, to some degree.

Q63   Mark Garnier: I wanted to ask you a bit more about that.  What is the value of this private sector involvement?

Jon Whitfield: It is budgeted at around £2 million this year.

Q64   Mark Garnier: It is quite a small proportion.  Do you pay for that or again is that charged out to your clients?

Jon Whitfield: It is charged out to clients.

Q65   Mark Garnier: It is actually a very small budget, is it not, when you think about some of the stuff you could be getting in, in terms of a percentage of your £30 million?[3]

Jon Whitfield: Yes.  From memory, the actual outturn is forecast to be a little higher than that, but the proportion is that around a fifth of the work that we do is by the private sector.

Q66   Mark Garnier: The Civil Service Reform Progress Report from December 2014 states that one of the objectives of your agency is to “reduce dependency on the private sector”.  Do you think you are achieving that?

Jon Whitfield: I would like to unpick what that means a little bit.  I like to think of it as better use of the private sector.

Mark Garnier: It does specifically say “reduce dependency on the private sector”.

Jon Whitfield: Let me answer that specifically.  The way in which we have used the private sector in the past is for a combination of access to specialist audit resource that we have not been able to retain in house, but also to smooth fluctuations in demand.  We have paid premium rates with the firms to do work that in‑house people are capable of doing but, because of the scheduling of the work, there just is not the capacity to do it. 

We also have an ambition, and this goes to your most recent question, to increase the amount of technical specialist auditors we have in house, in a number of areas.  The obvious and perhaps best example to use is in terms of IT assurance, where we have not done much IT work with our in‑house resource in the recent past, but have contracted out the majority of it to the private sector. 

We have a head of IT assurance from one of the firms on an 18‑month secondment to us at the moment, and part of his remit is to assess our in‑house capability.  We will shortly be going to the market to recruit some IT auditors, and part of the reason for doing that is to test the market.  I have asked the individual to help me identify a realistic level of in‑house technical IT audit resource that it is feasible for us to keep.  Where should the line be drawn between what we can realistically retain in house and what we are always going to have to contract out?  There is no ambition to completely wean ourselves off private sector support—that would not be realistic—but we can draw the line in a more sensible place and have a better and more capable in‑house function, including the ability to act as a more intelligent customer for what we buy in from the firms.

Q67   Mark Garnier: I suppose that is fair enough.  I completely appreciate your quite intelligent answer about this; at the end of the day, there is no point in packing your staff with experts who are then not used.  I get what you are talking about.  The layman will look at “reduce dependency on the private sector” essentially as reducing that bill of £2 million of outsourcing.  Are you on target to reduce that £2 million bill, in real terms?

Jon Whitfield: We are not this year.  A number of things affect it, first of all the demand from our customers.  If they demand more technical work that we do not have the capacity to do in house, as a service provider, we must ensure that we provide that.  It is going to take time to build our in‑house capability such that a greater proportion of that can come within our in‑house resource.  The difference between the budgeted figure for the use of private sector support for our service and the outturn figure is fundamentally from two areas: one is the increase in demand I have already referred to, and the other is the fact that we have vacancies within the agency, which we have not been able to fill.

Q68   Mark Garnier: Presumably you are filling those from outside Government, from the private sector.

Jon Whitfield: Although there are exceptions to this, the policy is usually first to seek to fill vacancies from advertising within Whitehall.  If we are unsuccessful, then we go out to the private sector. 

Q69   Mark Garnier: Could you give us a sense of what proportion of your front‑end staff has come from the private sector, compared to what has come from within Whitehall?

Jon Whitfield: I cannot give you any statistics off the top of my head.

Mark Garnier: Can you give us an order of magnitude then?

Jon Whitfield: I can say that more have come from the private sector in recent times.  I am reluctant to quote figures, but in the last two years a much higher proportion have come from the private sector than have come from Whitehall. 

Q70   Mark Garnier: What is attracting them to your organisation?

Jon Whitfield: Of those I have spoken to, it tends to be the interest that they recognise the work represents.  Government is a fascinating place to work and, to some degree, the advent of the agency has opened more options for people coming into Government internal audit.  Before the construct of the agency, those wishing to do so would join the internal audit units of a single Government organisation.  When the NAO did their review in 2012, they cited 400 different organisations with an internal audit function, so they would join one of those.  Clearly, that would give them a somewhat limited horizon in terms of their work.  That is part of it. 

There is a perception, certainly among those who work in the firms, that they are able to strike a better work/life balance working in the public sector, which perhaps has a better policy towards flexible working.

Q71   Mark Garnier: There are public sector employees across the country who will be outraged at the suggestion that you work less hard in the public sector.

Jon Whitfield: We do not work less hard.  There is greater scope for flexible working.

Q72   Mark Garnier: Can I just ask one final question?  How are you going to guard against this problem that we see in so many areas of Government, for example with the financial regulators, where people get to a certain point in their career in the private sector and they see that, in order to make that leap into the real senior roles, they spend two or three years working for the FCA and then come back as Goldman Sachs’s head of compliance?  How are you going to guard against people coming to you, spending two or three years working with you and then going back to being head of government audit at KPMG or the equivalent?

Jon Whitfield: I do not have a problem with them doing that.

Q73   Mark Garnier: Nonetheless, it is very bad for succession planning if you have people there for two or three years.  It becomes very difficult for any organisation when people are cycling through quite quickly.

Jon Whitfield: There is a balance there.  Historically, there has been far too little churn in the internal audit units within Government.  That has been bad for the internal audit service.  There are just over 700 people, last time they were counted, who are practising internal audit within Government.  There are something like 14,500 people working in finance in central Government.  The way that the finance profession recruits into the Civil Service fast stream represents an untapped resource for us.

Chair: That is a very interesting point.

Q74   Mark Garnier: This is what I was going to pick up on.  Most people would find that comment, where you are saying that it is quite a good thing or that you have no problem with high turnover, as being a very surprising reaction.  One of the problems if you have a high turnover of staff is that you lose that body of corporate experience and corporate knowledge, which people find very valuable.  At the end, you hinted that you can draw in other people’s expertise from outside, which is why it is a good thing.  Nonetheless, how are you going to get that corporate body of knowledge and longevity?

Jon Whitfield: It is absolutely a question of balance.  My view is that the balance at the moment is not right and we have insufficient churn through the profession.  I am trying to encourage more.

Q75   Mark Garnier: What is the advantage of churn?

Jon Whitfield: It is people coming in with fresh ideas.  I want the brightest and the best to come and work in internal audit.

Q76   Mark Garnier: You do not want the brightest and the best to leave.

Jon Whitfield: If I am getting the brightest and best, they cannot really stay.  There are insufficient senior roles for them.  I want people who come in with an ambition to go to the most senior ranks in the Civil Service and, to do that, I want them to see internal audit as what I believe it can be, which is a great stepping stone for their careers, where they can learn around governance, risk management and control, and use it as a springboard for their wider careers.  This is a model that is not uncommon in the private sector.  We have never cracked it; we have never attracted people.  Part of my job is to make the agency an attractive place for people with talent and potential to work.  That is true of the people who are already in the Civil Service, as well as those who might want to join us from outside. 

Chair: That was a very interesting final set of exchanges.  In the private sector, a great effort is made to make sure that the internal audit departments in major firms are refreshed constantly to try to obtain that set of ideas, rather than to become a stultified group who end up doing it for half their careers.  Of course, it is linked to the external audit requirement for periodic change. 

More generally, there has been a good deal of concern around the table about some of the things we have heard this morning.  There is an opacity about who is responsible for what, in deciding your agenda.  We do not have your business plan to hand; it is not even published.  It is still not clear which agencies you are responsible for, and we found out about the departmental lines of accountability from a vacancy notice, rather than from your website.  Nor is it clear what metrics are going to be used to measure your success. 

This Committee will be extremely keen to see your agency become a success and to do what it can to safeguard your independence.  The next step might be for us to have an exchange of letters, in which we ask for more information.  In the meantime, thank you very much for agreeing to send us the internal audit report of November 2014 on Kids Company, which we will scrutinise, and for agreeing, as you did earlier, to reflect on one or two of the points that have been raised in exchanges.  Thank you for coming to give evidence today. 

              Oral evidence: Government Internal Audit Agency, HC 786                            2