Corporate governance report

Statement of the Accountable Officer’s responsibilities

Under section 19(4) of the Public Finance and Accountability (Scotland) Act 2000, Scottish Ministers have directed Revenue Scotland to prepare for each financial year a statement of accounts in the form and on the basis set out in the Accounts Direction. The accounts are prepared on an accruals basis and must give a true and fair view of the state of affairs of Revenue Scotland and of its income and expenditure, Statement of Financial Position and cash flows for the financial year.

In preparing the accounts, the Accountable Officer is required to comply with the requirements of the Government Financial Reporting Manual (FReM) and in particular to:

• observe the Accounts Direction issued by Scottish Ministers, including the relevant accounting and disclosure requirements, and apply suitable accounting policies on a consistent basis
• make judgements and estimates on a reasonable basis
• state whether applicable accounting standards as set out in the Government Financial Reporting Manual have been followed, and disclose and explain any material departures in the financial statements
• prepare the financial statements on a going concern basis
• confirm that the Annual Report and Accounts as a whole is fair, balanced and understandable and take personal responsibility for the Annual Report and Accounts and the judgements required for determining that it is fair, balanced and understandable

The Permanent Secretary of the Scottish Government (SG), who is the Principal Accountable Officer for the Scottish Administration has designated, in accordance with sections 14 and 15 of the Public Finance and Accountability (Scotland) Act 2000, the Chief Executive of Revenue Scotland as Accountable Officer for Revenue Scotland.

The responsibilities of an Accountable Officer, including responsibility for the propriety and regularity of the public finances for which they are answerable, for keeping proper records and for safeguarding the Revenue Scotland’s assets, are set out in the Scottish Public Finance Manual.

The Accountable Officer may consult with the SG Chief Financial Officer (CFO) on any aspects of the duties applying to Accountable Officers in the Scottish Administration. The Accountable Officer must consult the CFO on any action which they consider is inconsistent with their duties on financial, regulatory or propriety grounds, and specifically where they seek written authority from the Scottish Ministers or a direction from the Board of Revenue Scotland. In practice, the Chief Executive will delegate authority widely to other employees of Revenue Scotland but cannot, on that account, disclaim responsibility. The Chief Executive is responsible for informing the Principal Accountable Officer about any complaints about Revenue Scotland accepted by the Scottish Public Services Ombudsman (SPSO) for investigation and about the response to any subsequent recommendations from the SPSO.

As the Accountable Officer, I have taken all the steps that I ought to have taken to make myself aware of any relevant audit information and to establish that Revenue Scotland’s auditors are aware of that information. So far as I am aware, there is no relevant audit information of which the auditors are unaware.

I confirm that this Annual Report and Accounts, taken as a whole, is fair, balanced and understandable, and I take personal responsibility for the Annual Report and Accounts and the judgements required for determining that it is fair, balanced and understandable.

Governance Statement and Framework

Governance Statement

In the paragraphs below, I report on the governance arrangements in place within Revenue Scotland.

Governance Framework

Revenue Scotland is responsible for the administration and collection of Scotland’s wholly devolved taxes. The relevant powers and duties of Revenue Scotland, and of the Scottish Ministers are set out in the Revenue Scotland and Tax Powers Act 2014.

Scottish Ministers are responsible for appointing the Board of Revenue Scotland following a public appointment exercise, regulated by the Commissioner for Ethical Standards in Public Life in Scotland.

Ministers must not direct, or otherwise seek to control Revenue Scotland in the exercise of its functions but they may give guidance. This guidance must be published and laid before the Scottish Parliament unless Ministers consider that to do so would prejudice the effective exercise by Revenue Scotland of its functions. Scottish Ministers are responsible for setting rates, bands and thresholds relating to the devolved taxes, subject to the approval of the Scottish Parliament.

The Board of Revenue Scotland is collectively responsible for the leadership and direction of the organisation and for ensuring that it carries out its statutory functions effectively and efficiently. It may delegate any of its functions to an individual Board member, a committee of the Board, the Chief Executive, or any other staff member, but it will retain its responsibility for carrying out its function.

As the Chief Executive of Revenue Scotland, I am employed by, and accountable to, the Board of Revenue Scotland for the day-to-day running of the organisation and its operational performance. In this role I seek assurance that appropriate controls are in place across the organisation, and in respect of the partners whom we rely on to support us in delivering our objectives, and I can confirm that these have been in operation during 2024-25 and to the date of signing these accounts.

I am supported by the Senior Leadership Team (SLT), who oversee the day-to-day business of Revenue Scotland, with each member taking responsibility for a specific area. The SLT is made up of the Chief Executive, the Head of Tax, the Head of Corporate Functions and the Head of Legal Services.

Operation of the Board and committees

Our Board is responsible for the functions and powers of Revenue Scotland and delegates authority to staff through a Scheme of Internal Delegation. The Board sets the strategic direction for the organisation, oversees Revenue Scotland’s work and monitors performance, including the design and operation of risk and governance frameworks. They do this through scrutiny and, where appropriate, approval of:

• corporate plans and business plans
• key strategies and policies
• regular reports, including reports relating to risk management, corporate performance, tax compliance, staff, health, safety and wellbeing, changes in the devolved taxes, progress on the introduction of new taxes
• scrutiny of the Annual Reports and Accounts
• reports from the Audit and Risk and Staffing and Equalities Committees
• strategic engagement with key partners and service users

I can report that during 2024-25 the Board met on six occasions which included a Board strategy session (2023-24: six). During this time our Board scrutinised and considered a number of specific matters including:

• proposals set out within Revenue Scotland’s stakeholder engagement plan
• approval of the 2024-27 business plan
• approval of the Health and Safety Policy and policy statement
• development of the Data and Digital vision statement and progress to date for the data and digital programme
• the review of the Framework Document
• updates on the programme of activity related to the new taxes: Scottish Aggregates Tax and Scottish Building Safety Levy

Audit and Risk Committee

The Audit and Risk Committee (ARC) supports the Board and Accountable Officer through reviewing the comprehensiveness, reliability and integrity of the assurances produced in support of the financial statements. The terms of reference of the committee are published on Revenue Scotland’s website within the Board’s Standing Orders.

The committee fulfils its role through:

• scrutiny of risk management arrangements
• regular liaison with internal and external audit and scrutiny of their plans and reports
• considering and monitoring of responses to recommendations from internal and external auditors and other bodies
• review of the certificates of assurance produced by management as part of the financial reporting process and the Chief Executive’s governance statement
• overseeing the financial reporting process

Members of the committee during 2024-25 were Martin McEwen (Chair until 22 January 2025), Simon Cunningham (Deputy Chair until 22 January 2025 and Chair from 23 January 2025) and Robert MacIntosh (Deputy Chair from 19 March 2025). Stephen Ramsay and Julie Hesketh-Laird were appointed to the committee on 3 February 2025 as co-opted non-voting members.

The committee is also attended by the Chief Executive, Head of Corporate Functions, Head of Legal Services, Head of Tax, Head of Governance, the Head of Finance and representatives of internal and external audit as well as other staff as required.

I can report that during 2024-25 the committee met seven times, this included a strategy session on risk management (2023-24: six). The committee engaged in a number of relevant matters including:

• consideration of reports from Internal Audit
• consideration of reports from Audit Scotland including their interim audit letter
• a strategy session to review Revenue Scotland’s corporate risk register, with a focus on alignment to the new Corporate Plan 2024-27
• deep dive on the programme to deliver Scottish Aggregates Tax
• consideration of assurances around the introduction of new corporate IT systems for HR and Finance

The committee reviewed its effectiveness during 2024-25, using the checklist set out in the Scottish Government’s Audit Committee Handbook. It found no issues of concern which could affect its normal function.

Staff and Equalities Committee

The Staffing and Equalities Committee (SEC) advises and provides assurance to our Board and Accountable Officer on issues relating to: people; equality, diversity and inclusion; and health, safety and wellbeing.

During 2024-25 the committee continued to follow the new format for the operation of the committee that was introduced by the Board in 2022-23. This was aimed at ensuring a more strategic focus for the committee. Following their review, the committee agreed that this format continued to meet the needs of SEC and the Board, and should continue.

The terms of reference for the committee are published on Revenue Scotland’s website within the Board’s Standing Orders.

Members of the committee during 2024-25 were Jean Lindsay (Chair), Idong Usoro (Deputy Chair) and Ken Macintosh. Elizabeth Barnes was appointed to the Committee on 3 February 2025 as a co-opted non-voting member.

Staff attendees comprise the Chief Executive, Head of Corporate Functions, Head of Legal Services, Head of Tax, Head of People Services and Head of Governance. Further staff members attend as required.

I can report that during 2024-25, the committee met three times (2023-24: three) and engaged in a number of relevant matters including supporting the development and scrutiny of:

• the People Strategy and action plan
• staff survey
• workforce and succession planning
• health, safety and wellbeing, including the Health and Safety Policy, Policy Statement and Staff Handbook
• equality, diversity and inclusion (EDI), including the EDI Strategy and action plan

The committee reviewed its effectiveness during 2024-25 and found no issues of concern which could affect its normal function.

Assurances Provided to the Accountable Officer

I have received written assurances from my Heads of Service, who have responsibility for the operation and effectiveness of internal controls within Revenue Scotland’s Tax, Legal and Corporate Functions teams.

These assurances raised some issues in respect of financial controls within the organisation. The issues were identified by Audit Scotland and reported within their interim audit letter to our Audit and Risk Committee and some additional matters were identified internally relating to backlogs of work within the finance function.

Audit Scotland’s interim audit letter, summarising the audit work completed during their 2024-25 interim audit of Revenue Scotland, identified four issues. Two of these related to recommendations from the prior year which had since been addressed. The other two related to weaknesses in controls around user permissions and to four sets of reconciliations which had not been undertaken in full during the year.

The other matters identified internally related to other routine finance tasks which had lapsed during the year, leading to backlogs.

Prompt action was taken to establish a programme of work to address the issues identified, overseen by a Steering Group including senior representation from the Scottish Government’s Directorate of Internal Audit and Assurance.

All of the issues identified have been addressed and the backlogs all brought under control. I am pleased to report that, in undertaking this work, no fraud or losses of tax revenues were identified nor was there any delay to the annual audit process. The Board and Audit and Risk Committee were kept informed throughout and were assured by the action that has been taken.

In order to ensure that our controls are sufficiently robust and to prevent any recurrence of these issues, I have commissioned a review by our internal auditors which will examine the root causes and to make recommendations that will identify where we can enhance the controls we have in place.

The Accountable Officer of the Scottish Environment Protection Agency (SEPA) has provided me with assurance in respect of the statutory functions delegated to them by Revenue Scotland. No significant issues were raised with me by SEPA.

In conclusion, I can confirm that, based on the aforementioned written assurances received, there were no significant control weaknesses identified in the period under review.

Report on personal data incidents

Revenue Scotland manages, maintains and protects all information according to the requirements of relevant legislation, its own information policies and best practice.

Revenue Scotland has an Information Assurance governance structure which prioritises and manages information risks.

The governance structure:

• protects the organisation, its staff and our taxpayers from information risks where the likelihood of occurrence and the consequences are significant
• ensures adherence with statutory duties
• assists in safeguarding Revenue Scotland’s information assets

Revenue Scotland has a Senior Information Risk Owner (SIRO) and a number of Information Asset Owners (IAOs), who provide assurance to the SIRO that proper controls are in place. The SIRO role is to ensure information security policies and procedures are fit for purpose and are reviewed and implemented across all of Revenue Scotland’s business functions. 

The IAOs are tasked with ensuring compliance with statutory duties, knowing what information assets they ‘own’ and what information they handle, along with the relevant security requirements, sensitivity, importance and protocols for sharing of information assets.

In addition, our Information Governance Group (IGG) steers Revenue Scotland’s approach to information governance, reviews issues arising with regards to data protection, carries out horizon scanning in relation to new legislative and other developments relating to information governance, and monitors our compliance with our mandatory legal obligations.

Parliamentary scrutiny

As a Non-Ministerial Office, Revenue Scotland is accountable to the Scottish Parliament and, as such, can be called to appear before parliamentary committees to provide updates on operational matters, give evidence on tax related matters or provide written statements.

During 2024-25 Revenue Scotland attended Parliament on 19 November 2024 for an annual evidence session on Revenue Scotland’s performance during 2023-24.

Revenue Scotland’s Corporate Plan, supporting legislation and this Annual Report are published documents. The Corporate Plan 2024-27, on which this document reports, was approved by Scottish Ministers and laid before the Scottish Parliament on 28 March 2024 and this report will be laid before Parliament in October 2025.

Corporate plans, annual reports and accounts and minutes of Revenue Scotland Board meetings are available on the corporate documents section of our website.

Internal Audit

The Scottish Government’s Directorate for Internal Audit and Assurance (DIAA) provide Revenue Scotland’s internal audit service through a shared service arrangement with the Scottish Government.

DIAA produce an annual audit plan which is reviewed by the Audit and Risk Committee, who provide advice on the plan to the Board and the Accountable Officer. Regular updates on progress against the audit plan are presented by DIAA to the Audit and Risk Committee’s meetings.

The Memorandum of Understanding between Revenue Scotland and DIAA was also reviewed during the year, reconfirming the basis for this service going forwards.

During the year, DIAA completed audits on the following:

Commercial Relationship Management

This review looked at the controls in place to manage risk around our contract and commercial relationship management arrangements. It found a good understanding of the role that commercial relationship management plays within the organisation and a strong attitude and ability to develop it further.

A ‘Reasonable’ assurance rating was awarded, recognising that there were some areas where improvements were required to enhance the adequacy and effectiveness of procedures. These areas for improvement related to:

• providing clarity in relation to the governance structure for contract management
• due diligence on lower value contracts
• maintaining the contracts register
• providing contract extension/award recommendations in a timely manner

The report also recommended identifying actions to strengthen capability around commercial relationship management and to ensure that the organisation obtains the most benefit and added value from commercial relationships.

Stakeholder Engagement

This review looked at the controls in place to manage the risk surrounding our stakeholder engagement arrangements. The work considered the approach taken by Revenue Scotland and the benefits it had delivered.

A ‘Reasonable’ assurance rating was awarded, recognising that there were some areas where improvements were required to enhance the adequacy and effectiveness of procedures. The review found the overall controls and governance of stakeholder engagement were well managed and identified opportunities for improvement related to: improving capacity and capability across all teams to deliver a consistent standard of stakeholder engagement; improving guidance to facilitate a more consistent approach to recording of stakeholder engagement data; strengthening the lessons learned approach; and further developing the Stakeholder Engagement plan to provide more clarity and ensuring that the plan is followed consistently.

Information Management

This review evaluated and reported on the controls in place to manage the risk surrounding Revenue Scotland’s information management arrangements.

A ‘Substantial’ assurance rating was awarded. The review highlighted the organisation’s strong and compliant information management practices, which aligned with applicable Scottish Government guidance. It was noted that there was: a clearly defined Accountability Report Corporate Governance Report Accountability Report Corporate Governance Report Revenue Scotland Annual Report and Accounts 2024-25 Resource Accounts governance structure to support effective oversight; efficient information management gathering and dispersal methods; and robust data protection measures in place. It also recognised work to enhance information management capabilities and work to ensure that information management documents, strategies and policies were kept up-to-date.

Opportunities for improvement were identified in relation to the review of data held on shared drives, to ensure on-going compliance with organisational information management policies, and ensuring that information management roles held by staff were consistently reflected within individual’s annual work objectives.

Annual Assurance Opinion 2024-25

The overall annual assurance opinion provided by DIAA for 2024-25 was ‘Substantial’ assurance. This reflects DIAA’s opinion that Revenue Scotland’s risk, governance and control procedures remain effective in supporting the delivery of its objectives and that any exposure to potential weakness is low and the materiality of any consequent risks negligible. 

DIAA reported that the culture within Revenue Scotland continues to be open to audit and assurance, with the RS Senior Leadership Team engaging with designated DIAA contacts on key strategic and operational matters.

External Audit

External Audit is provided by Audit Scotland. The Audit Director is appointed under the Public Finance and Accountability (Scotland) Act 2000 to carry out the external audit of Revenue Scotland and the devolved taxes. During the year, the Audit and Risk Committee scrutinised Audit Scotland’s audit plan and received regular updates from them. The Independent Auditor’s Report can be found further in this publication.

As part of the 2023-24 audit undertaken by Audit Scotland, two matters were highlighted for attention, namely:

• the risk that the related party disclosure may be incomplete or inaccurate
• the scope for medium-term financial planning arrangements to be developed further to highlight and ensure financial sustainability

Action to address these matters is underway and is expected to be completed during 2025-26.

Audit Scotland issued an interim audit letter in May 2025, in which they summarised the audit work they had undertaken during their 2024-25 interim audit of Revenue Scotland and identified some risks related to financial controls which required to be addressed. Details of the organisation’s response to this letter are set out in the Assurances Provided to the Accountable Officer section.

Assessment of corporate governance

Revenue Scotland has in place a system of internal controls and policies which are designed to safeguard its assets, data and ensure the reliability of financial records in relation to operational and tax duties.

I have noted above the issues experienced in relation to some of our finance controls. I am satisfied that the action that has been taken has ensured that these controls are now all working satisfactorily. In addition, the review by our internal auditors will provide me with additional assurance and expert advice on any further actions we should be taking to ensure that these controls are as robust as they can be moving forward.

I continue to ensure that these controls are subject to review by management on a regular basis. Our internal controls also undergo formal review by both Internal and External Audit, whose reports are made available to the Audit and Risk Committee. Having assessed our corporate governance arrangements, I confirm that they comply with generally accepted best practice principles and relevant guidance.

Risk management

I have assessed our risk management arrangements and confirm that they are in accordance with the guidance set out in the Scottish Public Finance Manual. The year-end Certificates of Assurance include a dedicated section assessing the effectiveness of Revenue Scotland’s risk management approach over the year and no significant control matters were raised. This, alongside the detailed review of the Corporate Risk Register undertaken with our Audit Committee and the assessment of risk throughout the year, contributes to my overall confidence assessment offered; further confirming that robust arrangements and practices were in operation throughout 2024-25.

Elaine Lorimer – Chief Executive of Revenue Scotland and Accountable Officer

02 October 2025