Public Accounts Committee
Oral evidence: National Audit Office Estimate 2019-20, HC 879
Monday 12 March 2019
Ordered by the House of Commons to be published on 12 March 2019.
Members present: Meg Hillier (Chair); Bim Afolami; Sir Geoffrey Clifton-Brown; Martyn Day; Chris Evans; Luke Graham; Layla Moran; Anne Marie Morris; Lee Rowley; Gareth Snell.
Marius Gallaher, Alternate Treasury Officer of Accounts, was in attendance.
Questions 1-27
Witnesses
I: Sir Amyas Morse, Comptroller and Auditor General, National Audit Office, and Daniel Lambauer, Executive Leader, Strategy and Operations, NAO.
Witnesses: Sir Amyas Morse and Daniel Lambauer.
Q1 Chair: Welcome to the Public Accounts Committee on Monday 11 March 2019. Today we are looking at the National Audit Office estimate for 2019-20. The procedure is that we will examine the NAO on this issue and then make a recommendation to the Public Accounts Commission, which is chaired by our colleague Sir Edward Leigh. The Commission is the body that then determines the budget for the NAO for the next year.
I want to kick off by asking you, Sir Amyas, about the difference in balance between what you are spending on financial audit and on value-for-money work. Can I focus first on financial audit? You plan to spend more on audit insurance this coming year than has been spent in the past year—it is a rise of 8.8%. I am wondering what factors are driving up those costs.
Sir Amyas Morse: Thank you, Chair. First, the most obvious point is that we are getting a lot of new work, and we are likely to have more because there are likely to be separate bodies formed in the coming year, if there is a post-Brexit period, as a result of bodies in the UK taking over activity from the EU and doing what would have been done by the EU. So every year we are getting more and more audits. In addition—
Q2 Chair: I just want to be clear. You have taken on the Bank of England and the BBC in the past year or two.
Sir Amyas Morse: We are getting a lot of quite small ones as well, and on quite a regular basis; we are getting some 20 audits a year added to our work. They are obviously not on the scale of the BBC. The Treasury Officer of Accounts said to me proudly the other day that it is his deliberate objective to get us as much work as possible—and I think it is fair to say that he is being very successful in that.
Q3 Chair: Are you going to have to take on more staff as a result?
Sir Amyas Morse: In part, but the other reason we are having to spend more money is that the nature of our audit basis is changing. There are more corporate audits, and we even have what are described as public interest entity audits—I am afraid they are known as PIEs in the business. These are quite complex audits, with quite high technical requirements.
Of course, we are also regulated by the Financial Reporting Council. We chose to do that. We are the only one of the supreme audit institutions in the UK to have a significant and growing number of corporations that are directly regulated by the FRC. In addition, we adopted the same improvement in audit standards that the big four have with the FRC, which is to try to drive ourselves up to a level of 90% for no material improvements in the audits examined.
Therefore, for a number of reasons to do primarily with quality and a more complex mix, we are having to spend more money—really just to recognise those factors. It is not because we think it is more important to do financial audit or anything like that; it is just that the more challenging technical environment means that we need to invest more.
Q4 Chair: On the other side, you are reducing spend on value-for-money work by 5.8%, so not quite as much as you are increasing the other spend by, but will we see a difference in the work that comes through to Parliament on that, and are they directly linked? Is it the case that because of one increase, you are having to reduce the rest?
Sir Amyas Morse: Not really. We are absolutely committed to our work for Parliament. I don’t think you will see any difference at all. There is no intention that we would. If we thought there was any difference, we would go back to TPAC—the Public Accounts Commission—and ask them for a change in funding arrangements so that we could actually do whatever work was needed. At the moment, our costs have gone down a bit because, as you know, we are doing a mix of investigations and value-for-money work, which generally takes about twice as long as an investigation. That has had a bit of an effect, but it is certainly not designed to be a money-saving enterprise. As I say, depending on the environment that we have to report on, we will react. We absolutely realise that providing services to Parliament is our No. 1 priority. We are very clear about that.
Chair: Given that we fund you, that is a very diplomatic thing to say.
Sir Amyas Morse: Thank you. I had noticed that as well, Chair.
Q5 Sir Geoffrey Clifton-Brown: Sir Amyas, may I bring you on to the vexed subject of the EU? You make a statement in this briefing to us that you are concerned that the resources taken out of various Departments to deal with Brexit might lead to a slowing down in their preparing their accounts. Do you foresee that as a real problem?
Sir Amyas Morse: Not at the moment, and the reason I say that is that I do something called annual review meetings with Departments. I am doing that at the moment, and all the Departments I have visited are relatively bullish about getting their accounts done for the normal time, before the summer recess, but that is in the absence of knowing what will happen on Brexit. I am reasonably reassured, because I would hope that in most cases they would not draft the accounting staff out to do something in response to Brexit. We are in completely unknown territory, and there is no doubt that some areas, such as management and information and so forth, may suffer a bit as a result. There are large numbers of people moving around different parts of the civil service to provide firepower for Brexit, so I can’t see an effect so far—but I probably wouldn’t have seen it yet.
Q6 Sir Geoffrey Clifton-Brown: You have already done 15 excellent Reports. That is quite a big new workload this year. Do you foresee that rate of workload increasing in the forthcoming year? Obviously this is, to a degree, crystal ball gazing, because we do not know whether we will leave with a deal.
Sir Amyas Morse: In many ways, it may be different. You will remember that what we did was to try to build up a picture of what was going on in relation to Brexit, because people really weren’t being informed of very much. A lot of the Reports were briefings—quite short and simple—at the beginning, so 15 probably sounds like more than it really was.
We are already planning to produce a future Report to set a baseline for how both the Department for International Trade and the various other Departments are going to organise themselves for doing trade agreements. If we see the blooming of a lot of trade agreement negotiations, I suspect that we will have to focus on that. If it turns out that there is a more difficult Brexit process, we will probably be looking at that and doing more short forensic work. It is difficult to tell.
So far we have taken a pretty prudent view on money and have just said, “We’ll have a central team, pretty much like we have now.” Most of the work we have done on Brexit has been out of our existing budget—simply refocusing our existing budget—so for now we are more or less there. We will come back to TPAC if we find that changes radically, but right now that is where we are.
Q7 Sir Geoffrey Clifton-Brown: Moving on to the subject of restoration and renewal in this place, which will be a very expensive budget, I have two questions. You haven’t put anything in the budget at the moment, presumably because the Bill hasn’t gone through to become law. Is that correct?
Chair: For the record, Sir Amyas is nodding.
Sir Amyas Morse: Yes.
Q8 Sir Geoffrey Clifton-Brown: What do you expect that to cost, if the Bill goes through in its current form?
Sir Amyas Morse: I do not necessarily assume that it will be an enormously costly piece of work for what we are doing, which will be some financial audit and obviously value-for-money work. If it turns out to be different from that, we will come and apply for money, but I am always pretty prudent about asking for money when I don’t really know what is likely to happen. I expect, and very much hope, that we will have access rights to both the contractors and the programme company, and all the way up. We will do financial audit and a series of Reports. As things start going, we will obviously do a Report to paint a picture of what is going on. After that, I expect it would be quite similar to other major projects—we will report on it either every year or every second year, as far as value for money is concerned.
Q9 Sir Geoffrey Clifton-Brown: As this is a parliamentary project, do you expect to comment on the budgets in any way as the Bill is going through Parliament?
Sir Amyas Morse: I would not expect to comment on them as they go through Parliament, but it may become evident—
Sir Geoffrey Clifton-Brown: As the Bill goes through, will you provide any commentary?
Sir Amyas Morse: I haven’t arranged to do that so far. It is possible that I might be called upon to do so.
Q10 Sir Geoffrey Clifton-Brown: On a different subject, you have commented in the past on local government audits. You think that, on the whole, local government auditors are doing a good job, but that the Ministry of Housing, Communities and Local Government is not assimilating the information that the auditors provide quickly enough to prevent another Northamptonshire occurring. Is that still your view?
Sir Amyas Morse: I did a Report on local government audit about two months ago. In that Report, I made the point that the appointed auditors of local authorities were calling out a lot of issues, particularly on arrangements for delivering value for money. My concern was not about the auditors blowing the whistle; it was about what the local authorities did as a result, which in some cases was not very much. I deliberately went on the record about that, because I felt quite concerned. You have got an audit process, and you have got people making reports with qualified results. They have done their job and pointed things out, and then there is not enough active response to it.
I also think that we are faced with a particular problem with NHS foundation trusts, which also have a separate audit, and you heard from witnesses here when they say, “We know everything that is done in this audit.” Well, what is the point of having the audit if they are not going to pay attention to it? Again, quite a significant percentage of those audits were qualified. The audit function is working, but what people do with it is a different question.
Chair: It is a matter for us to consider too.
Q11 Anne Marie Morris: Sir Amyas, this question is driven by my ignorance, so please forgive me. To what extent are you able to determine how much of the NAO’s time is spent on value for money, and how much is spent on audit? Is there a statute, or something or somebody, who says “There is a duty you must fulfil, and therefore you need to do more of this and less of that”?
Sir Amyas Morse: Not really; not in that way. What I would say—I must bring in Daniel in a moment—is that by implication it is approved, because I go to TPAC and I have a strategy session with them, as well as a budget session. At the strategy session, I explain what our plans are at that level. They ask whatever questions they want and understand and buy into the strategy, which would include the balance of effort that we are making. We are asked about that on a regular basis.
Q12 Anne Marie Morris: In practice, given that you know you are going to be grilled when you get to see them—after you have seen us—and given that clearly you want to ensure value for money and that you do not overspend, how do you determine how you split those two pots?
Sir Amyas Morse: To be honest, I determine it by looking at need. I did not start the process of thinking of how much resource I was going to spend on financial audit this year by saying, “I’m going to give them more money.” I started by realising that there was pressure there, and that is why we have applied for an increase in our budget—quite a small increase, but we applied for it. If I had felt that we did not have enough resource to increase financial audit, I would not have therefore reduced value for money; I would have asked for more resource.
In these times, we are playing quite an important role, and I do not think the right thing to do is to save a few hundred thousand pounds and fail to ask the right questions—I would never have done that. I sincerely think that we have the right amount of resource for financial audit, and we have the right amount of resource for value for money.
Q13 Anne Marie Morris: The Report says that you will be spending less on value for money, because you want to ensure quality. What should we read from that? Are you concerned that what you do now is pushing the envelope and you cannot really give it the time to give it the quality? There is a quality issue and a quantity issue.
Sir Amyas Morse: Let me bring in my colleague, Mr Lambauer.
Daniel Lambauer: The quality point is very much on the financial audit side—I think that answers the Chair’s question at the beginning. On the VFM side, the budget lines basically reflect what is already happening in our business. We have committed to produce around 60 or 65 major outputs a year. Every year, we look at the budget we need to do that and to provide additional support services to your Committee and others—
Q14 Anne Marie Morris: Before you go on, you say you need to do x number of reports. How do you determine what x is?
Sir Amyas Morse: Primarily by looking at what needs to be examined. In other words, if you think about the dialogue we have, it becomes pretty clear to me if I look at all the issues in Health, for example, and think about how often we need to look at that. That is a good example, because we do roughly six Reports on that a year, give or take. We are looking at all the very complex spectrum of things in Health, how they are developing, and whether they are well under control or not.
If we did not need to do more than four reports, I would not do more. I do not just fill up a rota. You see it going up and down. For places such as DEFRA, for example, where they are very much on point at the moment, we are doing a lot of work on DEFRA. Normally, we do one report every two years on DEFRA. We are extremely reactive to where the issues are.
Of course, that is different in financial audit, because in financial audit the activity is not driven by issues but by sets of accounts that have to be audited. That is a more mechanical process. The more sets of accounts and the more complicated they are, the more work we have to do, whereas on VFM it is as I have said: making sure that we cover off the issues and we are responsive to yourselves.
Q15 Anne Marie Morris: I suppose the question then is: if it is responsive, how can you budget, because you do not know what you will have to respond to? What are the assumptions you make?
Sir Amyas Morse: A lot of it is not zero-based. If you think about it—let me carry on with Health for a moment—we know perfectly well that we are going to do a financial sustainability report on Health. We can plan ahead and say, “We are going to do something on cancer treatment waiting times next year.” It is not as if we are sitting there saying, “I just wonder what might come up.” What happens is that we analyse the sector carefully, we have plans and we bring them forward. In addition, things always turn out differently from how you think they will, so you have to be flexible. You have a model of what you think it will be and then you are flexible with that.
Q16 Anne Marie Morris: So what assumptions have you made? Have you assumed x on Brexit, just as a starter for 10?
Sir Amyas Morse: Brexit was probably the most difficult part of it, because we really did not know and because we are doing different types of reports—short briefing reports and much bigger ones. That was a voyage of discovery.
You have just had our Report providing an update on borders. We did that whole thing in a very short period of time. We did it because I could see the developing situation. There were a lot of questions about borders and there was a gap there; it had been quite a long time since we had done the last Report. We needed to get in there with something to update the Committee. Sometimes you just have to react like that.
Q17 Anne Marie Morris: That is helpful. I have a final question. If things happen—“Events, dear boy; events”, as they say—and you need to do more on the VFM side, how will you do that? Will you go and ask for more money or cut back on what you do commercially?
Sir Amyas Morse: No, I would ask for more money.
Anne Marie Morris: And there is a process for that.
Sir Amyas Morse: Yes. We would do that only if we thought they were really important events. In that case, it would be vital that Parliament had independent testimony about them.
Q18 Chair: I cannot think of a time, in my time, when the NAO has come back to us for more money mid-year.
Sir Amyas Morse: No, we try not to do that.
Daniel Lambauer: I think the only supplement we had was when we got the BBC mid-year, but that was already planned in—
Chair: Exactly—that was planned.
Daniel Lambauer: The one thing to point out is that in our strategy in the estimate, we are asking for a small £600,000 contingency fund, which in previous years we usually had used for pay, and if we did not use it for pay, we gave it back. We are quite explicit in the strategy that this year, if we needed to hire staff on short notice, because of Brexit, we may use it for that. You may remember this discussion from a previous Public Accounts Commission meeting.
Q19 Chair: I want to ask you, Mr Lambauer, about cyber-security, which we have looked at across the piece. Given the sensitivity of what you are dealing with right through Government and Government bodies, are you able to get the right cyber-security experts in and what are the challenges? Are there any additional costs looming—as it is a long-term plan—that we ought to be aware of?
Daniel Lambauer: We are well aware of the issues from the work that we are doing ourselves, and we take it very seriously. That is why we set aside in our budget an additional £400,000 to £500,000 a year within the strategy period. We have also created a separate central information security team, which has experts in it, as you said. For our own assurance, we get external assurance and have achieved external accreditation against common benchmarks, to be sure ourselves that we have the right and adequate defences. The £400,000 to £500,000 will go on a range of investments we are making over the years, to ensure that we have adequate defences.
Q20 Chair: Obviously, some of that will be software. How much goes to cyber-people, and are you able to recruit in the market? We know that is a big challenge.
Daniel Lambauer: Our central information security team is formed of 2.5 FTEs. That is the team that holds to account the digital services team. There are separate people in digital services who are responsible for ensuring that we configure the systems correctly. Of course, in some of the software that we are buying—cloud-based software, where you buy software as a service—you basically buy the security as part of the package. On security we have roughly four people.
Q21 Chair: So you are relying a lot on your 800-plus staff, to ensure that they are individually complying.
Daniel Lambauer: That is a really good point. Part of the £400,000 is there in order to buy some external training. As you know, the No. 1 current threat is the online identity threat—staff being careless with online passwords, etc. So we are putting a lot of awareness campaigning in there. We do phishing exercises for our own staff, to ensure they don’t click on irrelevant links. We do penetration testing as well.
Q22 Chair: So you are setting up traps for your staff, to ensure that they are—wow, what a friendly place to work. I should not jest, because it is a very serious issue. I am glad that you are taking it seriously.
Sir Amyas Morse: It is worth quickly adding that it is the No. 1 risk for us in many ways, because we get access to all of this Government information. A few years ago there was some suggestion—a wrong suggestion, in my view—that we might have lost information from HMRC. It took years and years—this was all before my time—to get rid of that story and get back to just having normal access, or as normal as it is now. It is really quite a high risk. It is the number one risk for us. We take it more seriously than most people in Government.
Chair: It would be very damaging to the reputation of the National Audit Office. We are aware of that.
Q23 Sir Geoffrey Clifton-Brown: Sir Amyas, may I ask you a question about staff? Your budget, when the pension is stripped out, is going up by 1.2%, but you are proposing to increase the staff award by 2%. I suppose that this is a perpetual problem for you, in the sense that you are trying to provide Parliament with value for money, but on the other hand you are trying to provide excellent staff. How is your recruitment versus retirement ratio going?
Daniel Lambauer: You are absolutely right that there is quite a balance to be struck. Every year we commission a report around this time, where we benchmark ourselves against audit firms—big four firms—to see whether our offering is competitive. While what we are able to provide is definitely at the lower end of what firms are providing, we still think that it is a competitive offer. In terms of the actual turnover rate, the key one we always look at is the turnover rate for qualified accountants. That has been a bit higher than our target—the target is usually 15%, but in January it was around 21%. However, we saw that reduced in February and March again. We are also currently in the market to recruit for qualified accountants, because of the increased pressures on financial audit. That is going okay so far but, if I am being honest, we would hope to get better candidates. It is a fine balance—let’s put it like that. With what we have in the estimate, we feel confident that we can strike that balance.
Q24 Sir Geoffrey Clifton-Brown: I suppose the acid test is the vacancy rate. Is the vacancy rate going up or down?
Daniel Lambauer: As I said, for the qualified accountants the turnover rate is 21%—our target is 15%—but we have seen that reduced in February and March, probably to around 17%.
Q25 Chair: Presumably it is cyclical.
Sir Amyas Morse: It is still over the target, but by less. It is different. We train accountants, so you come out as a qualified member of the Institute of Chartered Accountants of England and Wales. That is a highly marketable person, and marketable in the private sector. We have to be conscious of that. It is not the same as with civil servants, because our people are more marketable.
Q26 Sir Geoffrey Clifton-Brown: Finally—sadly, in view of the fact that your 10-year tenure is coming to end on 1 May—if we were privy to a private note that you might write to your successor, what would you tell him is going really well at the NAO and what would you tell him he could actually improve?
Sir Amyas Morse: Well, what I would say to him, if I am honest—
Chair: You are restricted to a few minutes.
Sir Amyas Morse: I think a lot of things are on an upward curve, although that does not mean that they have arrived—we are never finished improving. I think someone else will bring different strengths out of the organisation. Whoever you are, you bring your contribution and then someone else will bring something different. I think that is just great. It will feel a bit different, which is great—it should be different. Each time you have a new leader, it should feel different.
Q27 Chair: I want to put on record that this is your last time appearing in front of us about the NAO’s budget, although you have a few more meetings to attend between now and the end of May. Hopefully you will still be worrying about the budget right up until the end of May. It will be your successor’s concern from now on. I hope, for his sake, that you have put in a bid that is right.
I think Mr Lambauer is on top of the numbers. I know the Treasury does not like the fact that you pay above inflation for your staff costs. You are saying that you lose qualified accountants at a rate of 21%. How many of your staff go over to civil service jobs and how many go to the private sector?
Daniel Lambauer: The latest data I have indicates that 52% of our staff go to the private sector and around 30% go to the public sector.
Chair: So your main competitor is the private sector. That is probably true for the Treasury too.
Marius Gallaher: I think that is right. We lose a lot of staff to the private sector after their experience in the public sector.
Sir Amyas Morse: They are after the Alternate Officer of Accounts all the time.
Chair: Thank you very much indeed. We will consider our response or letter to Sir Edward Leigh about what our recommendations are at the end of this hearing.