More than a year after Comhairle nan Eilean Siar became the victim of a major cyber attack, vital financial reporting continues to be seriously hobbled by data losses.
Councillors on the Audit and Scrutiny Committee will hear from officers this week that they cannot vouch for the accuracy of their reports due to the lingering effects of the security breach.
At least two reports being presented to the committee, which oversees accountability and transparency within the Comhairle, contain a formal cyber attack disclaimer.
One of these reports is a financial assessment of individuals who require residential care and the other examines spending on community planning and engagement.
Audit Scotland has also expressed concern about the data loss in their Annual Audit Plan 2023-24 report, which is coming before the committee.
Audit Scotland states that the cyber-attack has had a significant impact on the Comhairle’s financial management arrangements, including financial processes, systems, and controls.
Audit Scotland comments: “While the Council and its committees have continued to operate, the loss of data and access to information systems has resulted in the limitations in the data available to members and the public, including budget and performance monitoring information.”
This has been underlined by the admission contained in the Comhairle’s report on financial assessments undertaken for those requiring residential care.
The disclaimer in bold states: “It should be noted that our findings and conclusions are based on the information made available to us at the time of our review. There are current limitations in place as a result of a cyber-attack on 7 November 2023.
“This is likely to have limited our access to documentation prior to this date, which requires to be acknowledged when considering the contents of the report.”
Currently, 192 service users reside in Comhairle and independent private care homes. To date, for 2024/25, 132 financial assessments have been undertaken for service users. This includes those deceased, new assessments, and annual bills.
Finance officers are equally non-committal about their report on community planning and engagement, conceding: “Due to the cyber-attack, we had no access to the dedicated areas of information regarding the Community Engagement Unit.”
Meanwhile, the Audit and Scrutiny Committee meets on Thursday and will hear that only one of ten recommendations to strengthen data security has been fully implemented so far. Work is ongoing on the remainder.
Audit Scotland, the independent public body responsible for auditing most of Scotland’s public organisations, is also reflecting on the scale of the recovery process.
In their Annual Audit Plan report to councillors, Audit Scotland points out the cyber attack has had “a significant impact” on the timeliness of the accounts and the audit.
Audit Scotland says this will greatly increase the workload needed to “gain sufficient assurance over the financial statements”.
As a result, Audit Scotland is planning a 10% increase in their audit fee, which amounts to £26,910. They state this is in recognition of the increased workload resulting from the cyber attack and will be evaluated further as the audit progresses.
From a broader view, the cyber attack is impacting many other non-finance areas of Comhairle’s operations.
Chief Executive Malcolm Burr has warned that many transformation projects are being hampered.
While many ambitions were achieved, he comments that the required detailed project planning was found wanting in some cases and some work had been lost in the cyber attack.
The museum service has also been fighting to regain its full accreditation, as previously reported by welovestornoway.
