Case 030693. Appeal of the decision of the Department of Education and Science to refuse access to reports of internal audits undertaken between January 2000 and 12 March 2003 - whether disclosure of the records could prejudice the effectiveness of audits or the procedures or methods employed for conducting such audits - section 21(1)(a) - whether disclosure could have a significant adverse effect on the Department's management functions - section 21(1)(b) - public interest - section 21(2)

Case Summary

Facts

Deputy Enda Kenny appealed the decision of the Department of Education and Science to refuse access to reports of internal audits undertaken by the Department between January 2000 and 12 March 2003. The Department refused access to the reports on the grounds that, among other things, disclosure could result in harm to the capacity of the Internal Audit Unit to discharge its functions, disclosure could damage the existing expert/client relationship between the Internal Audit Unit and its clients and disclosure could result in destabilisation and circumvention of existing accountability arrangements. The scope of the request was narrowed during the course of the review to eight specified internal audit reports.

Decision

The Commissioner found that section 21(1)(a) did not apply. She did not accept that the Department's expectation of prejudice arising from the release of the records was reasonable. It was noted that such reports had been released by other Department's on foot of separate FOI requests without the harms envisaged by the Department of Education and Science arising. The Commissioner did not accept that the expert/client relationship between the Internal Audit Unit and its clients would be impaired as a result of disclosure of the records. She found that it was not sustainable that anything other than full co-operation would be given by public employees to the Department's Internal Audit Unit.

The Commissioner noted that in the case of a claim that section 21(1)(b) applies, there must be a reasonable expectation of "significant, adverse effect". Clearly, this is a more difficult test to satisfy than that applying in the case of section 21(1)(a) where the expectation is one of "prejudice". Having regard to the arguments made by the Department and to the contents of the records, the Commissioner concluded that there was no basis for this exemption in circumstances where she had already reached the view that the arguments made by the Department did not justify the exemption claimed under section 21(1)(a) where a lower threshold applies.

The Commissioner found that certain portions of three of the records contained personal information which was exempt under section 28(1).

Date of Decision: 24.05.2004

Our Reference: 030693

24.05.2004

Deputy Kenny

Dear Deputy Kenny

I refer to your application to this Office for a review of the decision of the Department of Education and Science on your Freedom of Information (FOI) request for access to internal audit reports undertaken in the Department between January 2000 and 12 March 2003.

At the outset, I would like to apologise for the delay in dealing with this application.

Background

On 12 March 2003 you applied to the Department of Education and Science for access to all internal audit reports undertaken in the Department between January 2000 and 12 March 2003. In its decision dated 3 April 2003 the Department refused access to the records on the basis that they are exempt under section 21(1)(a) and (b) of the FOI Act. On 1 May 2003 you applied for an internal review of that decision and on 23 May 2003 the Department decided to uphold the original decision. On 23 June 2003 you submitted a review application to this Office. On 29 October 2003, following discussions with this Office, you agreed to narrow the scope of your request to the following reports:

In carrying out this review, I have had regard to the following:

• your own submissions both as expressed in your letters to the Department and to this Office
• the conclusions of the Department on this matter and its submissions to this Office; and
• copies of the records at issue, made available to this Office for the purpose of this review.

I have carried out this review in accordance with the provisions of the Freedom of Information Acts 1997 and 2003. All references in this letter to particular sections of the FOI Act, unless where otherwise stated, refer to the FOI Act, 1997 as amended.

Scope of Review

The scope of this review is confined to considering whether the Department's decision to refuse access to the eight audit reports, detailed above, is justified by reference to the provisions of the FOI Act.

Findings

Section 21

The Department refused access to the records on the grounds that they are exempt under section 21(1). Section 21(1) of the Act, as amended, provides that a request may be refused if access to the record concerned could, in the opinion of the head, reasonably be expected to -

"(a) prejudice the effectiveness of tests, examinations, investigations, inquiries or audits conducted by or on behalf of a public body or the procedures or methods employed for the conduct thereof, (b) have a significant adverse effect on the performance by a public body of any of its functions relating to management (including industrial relations and management of its staff) ...........".

However, section 21(2) provides that exemptions under section 21(1) shall not apply if it is considered that the public interest would, on balance, be better served by granting than by refusing to grant the request.

The Department in its decisions and submissions maintained that the records should not be released for the following reasons:

• the Department's internal audit reports are already subject to scrutiny by, among others, the Office of the Comptroller and Auditor General and release of the withheld records could result in the destabilisation and circumvention of existing accountability arrangements and prejudice the effectiveness of those arrangements,
• potential harm to the capacity of the Internal Audit Unit to discharge its remit could arise from the general release of audit reports,
• the detailed procedures and methods employed for the conduct of such audits, to enable them to achieve their purposes, would be prejudiced by any determination of a general right of access to such records,
• the release of the information sought would raise complex professional and ethical issues,
• the general release of internal audit reports would subvert the intended internal audit raison d'être as it is bound to impair the management of mutual expectations in the context of existing expert/client liaison, where the internal auditor is generally viewed as being an honest and objective broker, and
• the general release of audit reports would be entirely threatening to the essence, independence and objectivity of the internal audit process.

While the Department submitted two lengthy submissions supporting its decisions, these submissions dealt primarily with the reasons why release would be contrary to the public interest. It should be noted that the public interest test at section 21(2) only applies where it is found that records are exempt under section 21(1) and consideration must then be given to release in the public interest.

In your application to this Office you argue that the internal audit reports requested have been completed and that, as completed reports, their release will in no way affect their findings. You also contend that release of the records "could not in any reasonable way prejudice the effectiveness of the internal audit unit of the Department of Education and Science". You maintain that there is a strong public interest in subjecting audit processes to public scrutiny to ensure objective audit procedures and you also say that you fail to accept that release of the records could in any way have a significant adverse effect upon the performance of the Department in its management function. In addition, you point out that other Government Departments, to whom you have made similar requests, have released audit reports to you in full or in part.

Having considered the arguments made by the Department in its original and internal review decision letters and in its submissions to this Office, I am not satisfied that either of the two exemptions claimed is justified. In arriving at a decision to claim a section 21 exemption, a decision maker must, firstly, identify the potential harm to the functions covered by the exemption that might arise from disclosure and, having identified that harm, consider the reasonableness of any expectation that the harm will occur. The test of whether the expectation is reasonable is not concerned with the question of probabilities or possibilities. It is concerned simply with whether or not the decision maker's expectation is reasonable.

Section 21(1)(a) Section 21(1)(a) envisages two potential types of "prejudice" which must be considered by a decision maker in terms of his or her expectations. The decision maker must hold the view that the release of the records will prejudice the "effectiveness" of the tests etc. or that release will prejudice the "procedures or methods employed for the conduct thereof". The use of the word "effectiveness" in section 21(1)(a) of the FOI Act must be interpreted as the ability of the audit to produce or lead to a result of some kind or the ability of the procedures or methods employed for the conduct of the tests to achieve their purpose.

Having examined the contents of the eight records now at issue, I do not accept that the Department's expectation, of prejudice arising from their release, is reasonable. As you pointed out in your review application to this Office, internal audit reports have been released by other Government Departments in the past and I am not aware of any suggestion that their release has resulted in any of the harms envisaged by the Department in this case. Further, it is clear that some other Government Departments did not anticipate that release of audit reports would have the prejudicial effect on the audit process anticipated by the Department in this case.

The fact that accountability arrangements may already exist in respect of audit reports is not grounds for refusing access under the FOI Act. Further, I do not accept that the work of the Office of the Comptroller and Auditor General, and/or others involved in scrutinising audit reports, would be prejudiced or compromised by the release of such reports under the FOI Act. Although the Department has argued that release of the records would prejudice the procedures and methods which it uses in carrying out such audits, it has not detailed specifically which procedures would be prejudiced or how they would be prejudiced. The Department has also argued that release of the records would impair the existing expert/client relation between the Internal Audit Unit and its clients. I do not accept that release of these records would lead to the Department's Internal Audit Unit staff being perceived as anything other than honest, objective and professional. As the Department has pointed out, some audit reports are already made available to the Public Accounts Committee without any apparent prejudice to the relationship between the Internal Audit Unit and its clients. Furthermore, it is reasonable to assume that all staff of public bodies will co-operate with audit inquiries where such inquiries relate to their work areas or functions. I consider that it is not sustainable that anything other than full co-operation would be given by public employees to the Department's Internal Audit Unit.

In the circumstances, I find that Department was not justified in its decision to refuse access to the records on the grounds that they are exempt under section 21(1)(a).

Section 21(1)(b)I have already noted that, in arriving at a decision to claim an exemption under section 21(1)(a) of the FOI Act, a decision maker must have a reasonable expectation of the anticipated harm arising from release. In the case of a claim that section 21(1)(b) applies, there must be a reasonable expectation of "significant, adverse effect". Clearly, this is a more difficult test to satisfy than that applying in the case of section 21(1)(a) where the expectation is one of "prejudice".

In invoking section 21(1)(b), a public body must make an assessment of the extent and significance attaching to the adverse effects claimed. Not only must the harm reasonably be expected but it must also be expected that the harm will be of a more significant nature than that required under section 21(1)(a). Having regard to the arguments made by the Department and to the contents of the records, I can only conclude that there is no basis for this exemption in circumstances where I have already reached the view that the arguments made by the Department do not justify the exemption claimed under section 21(1)(a) where a lower threshold applies.

Public Interest TestAs I have decided that neither of the two exemptions claimed under section 21(1) are justified, it is not strictly necessary for me to consider whether, in accordance with section 21(2), the public interest favours the full release or otherwise of the records in question. However, in the interests of thoroughness I will briefly consider the relevant public interest factors.

The Department contends that there is a significant public interest in the Internal Audit Unit being able to carry out effective audits in order to ensure good management of public services and finances; it argues that release of these eight audit reports would undermine the effectiveness of the entire audit process. I consider that the openness and accountability of a public body in the expenditure of public monies represents a very strong public interest argument in favour of release. As the former Commissioner found in Case Nos. 98049, 98056 and 98057 [Henry Ford & Sons Ltd, Nissan Ireland and Motor Distributors Ltd and the Office of Public Works]

"Such openness is a significant aid to ensuring effective oversight of public expenditure, to ensuring the public obtains value for money, to preventing fraud and corruption and to preventing the waste or misuse of public funds.

Motor Distributors Limited has argued that there are existing mechanisms to ensure accountability and that these are adequate. It is not for me to comment on the adequacy of such mechanisms. I do not accept that the existence of current safeguards in relation to public expenditure means that there is no public interest in creating further safeguards. The very existence of secrecy carries with it the scope for abuse. In contrast, openness in relation to public expenditure is an important additional safeguard against fraud, waste and misuse of funds. I consider that the public interest in openness about public expenditure is of very great significance."

In relation to the particular records now at issue, and were it the case that reliance on section 21(1) was justified, I consider that the public interest factors in favour of release would outweigh the public interest in protecting the Department's internal audit process from whatever prejudice or adverse effect might follow on from the granting of access to these records.

Section 28

Although not relied on by the Department, I consider that section 28 is of relevance in relation to portions of certain of the records. Section 28(1) provides:

"Subject to the provisions of this section, a head shall refuse to grant a request under section 7 if, in the opinion of the head access to the record concerned would involve the disclosure of personal information (including personal information relating to a deceased individual)"

Personal information is defined in section 2 of the FOI Act as including (a) information about an identifiable individual that would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) information held by the public body on the understanding that it would be treated as confidential. Having examined the records, I find that the reports on Shannon Comprehensive School (CC 009), Cork Youth Encounter Project (0T 0003) and Finglas Child and Adolescent Centre (0T 0004) contain some personal information in relation to third parties. The particular portions containing personal information are as follows:

Shannon Comprehensive School Report:

• Page 3 - Paragraph 3.3.1 - First sentence.
• Page 19 - Section dealing with 'Activities Current Account'- Last sentence of the first paragraph commencing "This account" and ending "during the audit".
• Page 20 - "Findings" section - Fourth bullet point - Text from "In relation to" to "funds separate".

Cork Youth Encounter Project:

• Page 11 - Paragraph 3.11.2 - Third bullet point commencing "Principal" and ending "rates".

Finglas Child and Adolescent Centre:

• Page 7 - Paragraph 3.7.2 - Sixth bullet point - Second sentence commencing "These invoices" and ending "Officer".
• Page 11 - Paragraph 3.9.3 - Final bullet point - Text commencing "On examining" and ending "was drawn on".

The effect of section 28(1) is that a record disclosing personal information of a third party cannot be released to another person unless one of the other relevant provisions of section 28 applies, in this case section 28(2) or 28(5). I find it is not necessary here to go into the details of section 28(2) as I do not consider the situations which it covers arise in this case and no case has been made that they do arise.

Section 28(5) provides that a record containing the personal information of a third party may be released if (a) on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld, or (b) the grant of the request would benefit that individual.

In my view the release of the personal information in this case, would not benefit the individuals to whom the information relates. However, the question of release in the public interest requires consideration. In order that you may obtain access to the personal information in the records, it is necessary to identify a positive public interest, which outweighs the privacy rights of the third parties. Given the nature of the references in question, and given that they represent a very small proportion of the overall record in each case, I have been unable to identify any public interest favouring release of the information which would override the public interest in the protection of the privacy rights of the individuals to whom the information relates. I find that section 28(1) applies to these portions of the records in question and these portions are, accordingly, exempt from release.

Decision

Having carried out a review under section 34(2) of the Freedom of Information Act, 1997 (as amended) I hereby annul the decision of the Department insofar as it relates to the following records and I direct that copies of them be released in full: DES 001 Audit Evaluation of Euro Changeover DES 002 Commission on School Accommodation DES 003 Audit and Risk Management Evaluation of the ICT in Education Programme EC 006 Kildare Education Centre OT 002 Audit of Maintenance Grants for Primary Schools I hereby vary the Department's decision insofar as it relates to the following records and direct that they be released with the following deletions:

CC 009 Shannon Comprehensive School Report:

• Page 3 - Paragraph 3.3.1 - First sentence.
• Page 19 - Section dealing with 'Activities Current Account'- Last sentence of the first paragraph commencing "This account" and ending "during the audit".
• Page 20 - "Findings" section - Fourth bullet point - Text from "In relation to" to "funds separate".

0T 003 Cork Youth Encounter Project:

• Page 11 - Paragraph 3.11.2 - Third bullet point commencing "Principal" and ending "rates".

0T 004 Finglas Child and Adolescent Centre:

• Page 7 - Paragraph 3.7.2 - Sixth bullet point - Second sentence commencing "These invoices" and ending "Officer".
• Page 11 - Paragraph 3.9.3 - Final bullet point - Text commencing "On examining" and ending "was drawn on".

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such an appeal must be initiated not later than eight weeks from the date of this letter.

Yours sincerely

Emily O'Reilly
Information Commissioner